Daniel Roe

5 exploits Active since Feb 2023
CVE-2023-0878 WRITEUP MEDIUM WRITEUP
Nuxt < 3.2.1 - XSS
Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.
CVSS 6.1
CVE-2023-2138 WRITEUP CRITICAL WRITEUP
GitHub module <1.6.2 - Info Disclosure
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
CVSS 9.8
CVE-2023-3224 WRITEUP CRITICAL WRITEUP
Nuxt < 3.4.3 - Code Injection
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.
CVSS 9.8
CVE-2025-24361 WRITEUP MEDIUM WRITEUP
Nuxt <3.15.12 - Info Disclosure
Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.
CVSS 5.3
CVE-2025-69874 WRITEUP CRITICAL WRITEUP
NPM Nanotar - Path Traversal
nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.
CVSS 9.8