CVE-2025-52662: Nuxt DevTools vulnerable to cross-site scripting (XSS)

November 7, 2025

A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade.

References

github.com/advisories/GHSA-xmq3-q5pm-rp26
github.com/nuxt/devtools
github.com/nuxt/devtools/commit/7cadbbe9
github.com/nuxt/devtools/releases/tag/v2.6.4
nvd.nist.gov/vuln/detail/CVE-2025-52662
vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools

Code Behaviors & Features

Detect and mitigate CVE-2025-52662 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →