medium6.9
CVE-2025-52662
Nuxt DevTools vulnerable to cross-site scripting (XSS)
Impact
A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @nuxt/devtools | < 2.6.4 | 2.6.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nuxt | Devtools | before 2.6.4 |