Nuxt IPC Socket Permission Flaw Leads to Local Data Disclosure (CWE-276)

Vulnerability Overview The Nuxt dev server vite-node IPC socket is world-connectable on Linux. When running on Linux (Node.js 20+, not in Docker or StackBlitz), Nuxt's internal vite-node IPC server binds to a Linux abstract namespace Unix socket ( ). Abstract sockets do not have file system nodes and therefore no permission bits; any local user can read to enumerate the socket and connect to it. Scope Affected Versions: - : >= 4.0.0, = 3.18.0, < 3.21.7 Impact Description: - The IPC server dispatches requests without performing any credential or shared secret checks. - Module request types are passed directly to Vite's SSR via the field, bypassing Vite's HTTP layer server restrictions. - A co-resident unprivileged local user can read arbitrary paths (e.g., or ) and exfiltrate developer secrets through the dev server's SSR plugin pipeline. - The request type additionally enables file system probing. - This affects multi-tenant hosts running on Linux (lab machines, shared hosts, CI runners sharing jobs rather than per-job container launches). - Not affected: - Production builds ( or ). - macOS or Windows developers. - Docker or StackBlitz environments, which already fall back to file system sockets. - Single-user laptops or per-job containerized CI. Remediation Patch: - Fixed in (commit ) and backported to (commit ). - The fix completely removes the abstract namespace branch. The IPC server now always binds to a file system Unix socket in the OS temporary directory and explicitly performs a after 998 seconds (post- ), restricting connections to the owning UID. If fails, the server closes the connection rather than serving requests over an unrestricted channel. Workarounds If immediate upgrading on affected hosts is not possible: - Run in a container or VM without other tenants. Docker already triggers a file system socket fallback in vulnerable versions, and this fallback is unaffected. - Bind the development process to a single-user namespace ( , unprivileged container). - Restrict visibility via . Use mount options where applicable, although this is a partial mitigation. References Affected file: CWE-276: Incorrect Default Permissions Credits Reported by Anthropic / Claude as part of Anthropic's coordinated vulnerability disclosure program, reference ANT-2026-MSNKZPAT. Thanks to the Anthropic Security Team for the detailed reproduction report and support. Independently reported by @alcho1111 via GitHub's coordinated disclosure process (GHSA-5yvc-46gx-948) as a duplicate closure of this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Nuxt IPC Socket Permission Flaw Leads to Local Data Disclosure (CWE-276)

More from this source