Repository navigation
[GHSA-2452-6xj8-jh47] Opening a malicious website while running a Nuxt dev server could allow read-only access to code - #11305
Conversation
|
Hi there @danielroe! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
🟢 Approval recommended
No active issues were identified, and the change is limited to adding a supporting Nuxt v3.15.3 release reference while preserving the existing advisory metadata.
No open issues 🎉
What changed in this PR
Adds the Nuxt v3.15.3 release as a supporting reference for GHSA-2452-6xj8-jh47, documenting the release containing the dev-server CORS security fix.
Changes:
- Added the Nuxt v3.15.3 release URL as a web reference.
- Preserved the existing advisory metadata and affected-version details.
| File | Description |
|---|---|
| advisories/github-reviewed/2025/01/GHSA-2452-6xj8-jh47/GHSA-2452-6xj8-jh47.json | Adds the Nuxt v3.15.3 release as a supporting web reference to the advisory. |
Review effort: Lite (dynamic)
Updates
Comments
Add the Nuxt v3.15.3 release as a reference. The release notes explicitly name GHSA-2452-6xj8-jh47 as a security fix and describe the dev-server CORS restriction. No other changes.