Vulnerability-Lookup

CVE-2025-59414 (GCVE-0-2025-59414)

Vulnerability from cvelistv5 – Published: 2025-09-17 18:39 – Updated: 2025-09-17 19:42

Title

Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival

Summary

Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/nuxt/nuxt/security/advisories/…	x_refsource_CONFIRM
	https://github.com/nuxt/nuxt/commit/2566d2046bccb…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	nuxt	nuxt	Affected: >= 3.6.0 < 3.19.0 Affected: >= 4.0.0 < 4.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59414",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-17T19:42:38.698134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-17T19:42:44.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.6.0 \u003c 3.19.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0 \u003c 4.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt\u0027s Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T18:39:38.193Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595"
        }
      ],
      "source": {
        "advisory": "GHSA-p6jq-8vc4-79f6",
        "discovery": "UNKNOWN"
      },
      "title": "Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59414",
    "datePublished": "2025-09-17T18:39:38.193Z",
    "dateReserved": "2025-09-15T19:13:16.903Z",
    "dateUpdated": "2025-09-17T19:42:44.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-59414\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-17T19:42:38.698134Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-17T19:42:40.621Z\"}}], \"cna\": {\"title\": \"Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival\", \"source\": {\"advisory\": \"GHSA-p6jq-8vc4-79f6\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"nuxt\", \"product\": \"nuxt\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 3.6.0 \u003c 3.19.0\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0 \u003c 4.1.0\"}]}], \"references\": [{\"url\": \"https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6\", \"name\": \"https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595\", \"name\": \"https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt\u0027s Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-09-17T18:39:38.193Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-59414\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-17T19:42:44.734Z\", \"dateReserved\": \"2025-09-15T19:13:16.903Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-09-17T18:39:38.193Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-59414

Vulnerability from fkie_nvd - Published: 2025-09-17 19:15 - Updated: 2025-12-03 18:47

Severity ?

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595	Patch
	security-advisories@github.com	https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6	Exploit, Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	nuxt	nuxt	*
	nuxt	nuxt	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A93E3D1-3CAE-47EF-A52F-E77C13FAA56E",
              "versionEndExcluding": "3.19.0",
              "versionStartIncluding": "3.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "48C5B681-0D99-46B1-A2FB-509870F61BD8",
              "versionEndExcluding": "4.1.0",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt\u0027s Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+."
    },
    {
      "lang": "es",
      "value": "Nuxt es un framework de desarrollo web de c\u00f3digo abierto para Vue.js. Antes de las versiones 3.19.0 y 4.1.0, una vulnerabilidad de salto de ruta del lado del cliente en el mecanismo de reactivaci\u00f3n de carga \u00fatil de Nuxt Island permit\u00eda a los atacantes manipular solicitudes del lado del cliente a diferentes puntos finales dentro del mismo dominio de aplicaci\u00f3n cuando se cumplen condiciones espec\u00edficas de prerrenderizado. La vulnerabilidad ocurre en el proceso de reactivaci\u00f3n de carga \u00fatil del lado del cliente (revive-payload.client.ts) donde las Nuxt Islands se obtienen autom\u00e1ticamente al encontrar objetos __nuxt_island serializados. Durante el prerrenderizado, si un punto final de la API devuelve datos controlados por el usuario que contienen un objeto __nuxt_island manipulado, los datos se serializan con devalue.stringify y se almacenan en la p\u00e1gina prerrenderizada. Cuando un cliente navega a la p\u00e1gina prerrenderizada, devalue.parse deserializa la carga \u00fatil. El reactivador de Island intenta obtener /__nuxt_island/${key}.json donde key podr\u00eda contener secuencias de salto de ruta. Actualice a Nuxt 3.19.0+ o 4.1.0+."
    }
  ],
  "id": "CVE-2025-59414",
  "lastModified": "2025-12-03T18:47:40.983",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-09-17T19:15:47.437",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P6JQ-8VC4-79F6

Vulnerability from github – Published: 2025-09-17 20:42 – Updated: 2025-09-18 13:04

Summary

Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

Details

Summary

A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.

Technical Details

The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. The issue affects the following flow:

During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object
This data gets serialized with devalue.stringify and stored in the prerendered page
When a client navigates to the prerendered page, devalue.parse deserializes the payload
The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences

Prerequisites for Exploitation

This vulnerability requires all of the following conditions:

Prerendered pages: The application must use Nuxt's prerendering feature (nitro.prerender)
Attacker-controlled API responses: The attacker must be able to control the response content of an API endpoint that is called during prerendering via useFetch, useAsyncData, or similar composables
Client-side navigation: A user must navigate to the prerendered page (not during initial SSR hydration)

Attack Scenario

// Malicious API response during prerendering
{
  "__nuxt_island": {
    "key": "../../../../internal/service",
    "params": { "action": "probe" }
  }
}

This could cause the client to make requests to /__nuxt_island/../../../../internal/service.json if path traversal is not properly handled by the server.

Impact Assessment

Limited Impact: The vulnerability has a low severity due to the highly specific prerequisites
No Direct Data Exfiltration: The vulnerability does not directly expose sensitive data
Client-Side Only: Requests originate from the client, not the server

Mitigation

Action Required: - Update to Nuxt 3.19.0+ or 4.1.0+ immediately - Review any prerendered pages that fetch external or user-controlled data

Temporary Workarounds (if immediate update is not possible): 1. Disable prerendering for pages that fetch user-controlled data 2. Implement strict input validation on API endpoints used during prerendering 3. Use allowlists for API response structures during prerendering

Fix Details

The fix implemented validation for Island keys in revive-payload.server.ts: - Island keys must match the pattern /^[a-z][a-z\d-]*_[a-z\d]+$/i - Maximum length of 100 characters - Prevents path traversal and special characters

Severity ?

3.1 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.6.0"
            },
            {
              "fixed": "3.19.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-59414"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-17T20:42:28Z",
    "nvd_published_at": "2025-09-17T19:15:47Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nA client-side path traversal vulnerability in Nuxt\u0027s Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.\n\n### Technical Details\n\nThe vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized `__nuxt_island` objects. The issue affects the following flow:\n\n1. During prerendering, if an API endpoint returns user-controlled data containing a crafted `__nuxt_island` object\n2. This data gets serialized with `devalue.stringify` and stored in the prerendered page\n3. When a client navigates to the prerendered page, `devalue.parse` deserializes the payload\n4. The Island reviver attempts to fetch `/__nuxt_island/${key}.json` where `key` could contain path traversal sequences\n\n### Prerequisites for Exploitation\n\nThis vulnerability requires **all** of the following conditions:\n\n1. **Prerendered pages**: The application must use Nuxt\u0027s prerendering feature (`nitro.prerender`)\n2. **Attacker-controlled API responses**: The attacker must be able to control the response content of an API endpoint that is called during prerendering via `useFetch`, `useAsyncData`, or similar composables\n3. **Client-side navigation**: A user must navigate to the prerendered page (not during initial SSR hydration)\n\n### Attack Scenario\n\n```javascript\n// Malicious API response during prerendering\n{\n  \"__nuxt_island\": {\n    \"key\": \"../../../../internal/service\",\n    \"params\": { \"action\": \"probe\" }\n  }\n}\n```\n\nThis could cause the client to make requests to `/__nuxt_island/../../../../internal/service.json` if path traversal is not properly handled by the server.\n\n### Impact Assessment\n\n- **Limited Impact**: The vulnerability has a low severity due to the highly specific prerequisites\n- **No Direct Data Exfiltration**: The vulnerability does not directly expose sensitive data\n- **Client-Side Only**: Requests originate from the client, not the server\n\n### Mitigation\n\n**Action Required:**\n- Update to Nuxt 3.19.0+ or 4.1.0+ immediately\n- Review any prerendered pages that fetch external or user-controlled data\n\n**Temporary Workarounds** (if immediate update is not possible):\n1. Disable prerendering for pages that fetch user-controlled data\n2. Implement strict input validation on API endpoints used during prerendering\n3. Use allowlists for API response structures during prerendering\n\n### Fix Details\n\n[The fix](https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595) implemented validation for Island keys in `revive-payload.server.ts`:\n- Island keys must match the pattern `/^[a-z][a-z\\d-]*_[a-z\\d]+$/i`\n- Maximum length of 100 characters\n- Prevents path traversal and special characters",
  "id": "GHSA-p6jq-8vc4-79f6",
  "modified": "2025-09-18T13:04:21Z",
  "published": "2025-09-17T20:42:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59414"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt/nuxt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-59414 (GCVE-0-2025-59414)

FKIE_CVE-2025-59414

GHSA-P6JQ-8VC4-79F6

Summary

Technical Details

Prerequisites for Exploitation

Attack Scenario

Impact Assessment

Mitigation

Fix Details

Tags

Sightings

Nomenclature