# CVE-2025-52662: XSS on Nuxt DevTools

By Steven Van · 2025-11-06

Nuxt DevTools 2.6.4 fixes an XSS-to-RCE chain that could exfiltrate auth tokens and overwrite config files in dev mode.

Vercel disclosed **CVE-2025-52662**, a medium-severity vulnerability chain in Nuxt DevTools that allows remote code execution in development environments. The DevTools authentication page rendered error messages without sanitization, enabling DOM-based XSS; an attacker could use that to steal authentication tokens, then use a path traversal flaw in the WebSocket message handler to write files outside the intended directory and overwrite configuration files, leading to remote code execution.

The issue is fixed in **Nuxt DevTools 2.6.4**, which now renders errors as textContent instead of innerHTML. Until upgrading, affected users are advised to avoid publicly exposing Nuxt DevTools or running Nuxt in production using dev mode. The vulnerability was responsibly disclosed by @yuske. Read the [full advisory](<https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools>) on the [Vercel](<https://creatorstoolbox.com/tools/vercel>) changelog.

![Vercel](<https://www.google.com/s2/favicons?domain=vercel.com&sz=128>)

Vercel

The platform for frontend developers — deploy, preview, and scale web apps and AI agents with zero config.

[View Vercel →](<https://creatorstoolbox.com/tools/vercel>)

[Original source](<https://vercel.com/changelog/cve-2025-52662-xss-on-nuxt-devtools>)

[Read CVE-2025-52662: XSS on Nuxt DevTools on Creators Toolbox](<https://creatorstoolbox.com/blog/vercel-cve-2025-52662-xss-on-nuxt-devtools>)

---
Canonical source: https://creatorstoolbox.com/blog/vercel-cve-2025-52662-xss-on-nuxt-devtools