{"affected":[{"product":"nuxt","source":"CNA: GitHub_M","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.5.0, < 4.6.4"}]},{"product":"schema","source":"CNA: GitHub_M","vendor":"@nuxt","versions":[{"status":"affected","version":">= 3.5.0, < 4.6.4"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@nuxt/schema","product":"@nuxt/schema","source":"OSV GHSA-mjrq-cffv-q4qc","vendor":"","versions":[{"events":[{"introduced":"3.5.0"},{"fixed":"4.6.4"}],"lessThan":"4.6.4","status":"affected","version":"3.5.0","versionType":"semver"}]}],"cveId":"CVE-2026-128070","cwes":["CWE-552"],"description":"Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":5.9,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794604663780,"publishedAt":1794590427855,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-mjrq-cffv-q4qc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/nuxt/nuxt/commit/89d3306d1976dd52ac2e73078806a3e889cbb8bd"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/nuxt/nuxt/commit/89d3306d1976dd52ac2e73078806a3e889cbb8bd"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-mjrq-cffv-q4qc"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-mjrq-cffv-q4qc"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-mjrq-cffv-q4qc"}],"remediation":[{"kind":"fix","source":"OSV GHSA-mjrq-cffv-q4qc","text":"@nuxt/schema (npm): OSV reports a fixed version 4.6.4. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-mjrq-cffv-q4qc"}],"revision":"0c0b1264884ec7fbb0e2ee675acf950d82de2154cb462132129acd1eca72f3ba","sources":[{"modifiedAt":1794604162550,"name":"CNA: GitHub_M","retrievedAt":1794607758555,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128070"},{"modifiedAt":1794604663780,"name":"NVD","retrievedAt":1794615574704,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128070"},{"modifiedAt":1794594603869,"name":"OSV / GitHub Security Advisories","retrievedAt":1794607759184,"url":"https://osv.dev/vulnerability/GHSA-mjrq-cffv-q4qc"}],"ssvc":{"assessedAt":1794604154953,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Nuxt dev server serves files from a parent directory that contains a lockfile","updatedAt":1794615574704}