-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @nuxt/vite-builder | npm | >= 3.8.1, < 3.15.3 | 3.15.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Nuxt's custom CORS handler overriding Vite's patched CORS implementation. The key vulnerable functions are: 1) The Vite client middleware handler that used h3's appendCorsHeaders with wildcard origins, visible in client.ts lines 257-263 pre-patch. 2) The Vite Node server middleware that exposed internal endpoints without origin validation. The commit 7eeb910 replaced the wildcard CORS implementation with origin restrictions and proper h3 handleCors usage, confirming these were the vulnerable points. The medium confidence for vite-node.ts stems from advisory notes about potential exploitation despite lack of explicit PoC for module IDs.
Ongoing coverage of React2Shell