A proof-of-concept demonstrating CWE-94 (Code Injection) in Nitro v3. Plugin file paths are interpolated directly into ES import specifiers as raw template strings with no sanitization. A double-quote character in a controlled path terminates the import specifier early, injecting arbitrary JavaScript into the generated server bundle. The payload executes on every server startup and persists in the build artifact after the source package has been removed.
This repository contains nitro_poc_calc.mjs, a self-contained demonstration that runs in two stages:
- Stage 1 replicates the vulnerable template logic directly with zero dependencies;
- Stage 2 installs
nitro@latestfrom npm, builds a real project with the crafted plugin path, and executes the resulting bundle.
Full technical write-up, attack vectors, remediation, and vendor response at shadowbumble.nl.
This proof-of-concept is provided for educational and research purposes only, including the development of detections, mitigations, and defensive telemetry. It is not intended for use against systems you do not own or lack explicit authorization to test.