A developer tool that listens on the Vite hot-reload port can become a command launcher on the machine running it. In affected Nuxt DevTools versions, anyone who can reach the HMR endpoint can call unauthenticated RPC methods and plant a saved command that later runs on the developer workstation.
INCIBE-CERT says Nuxt DevTools and the nuxt:devtools plugin before 3.3.1 are affected, and the issue is limited to development mode. The vulnerable path runs over the Vite HMR WebSocket and lets a remote client change persisted options, then trigger openInEditor so the stored value is executed as a child process; upgrading to 3.3.1 fixes it.