CVE-2026-71319 affects Nuxt DevTools prior to version 3.3.1, exposing an unauthenticated bidirectional RPC channel over the Vite HMR WebSocket. The vulnerability allows any client able to reach the HMR endpoint to invoke RPC methods without authentication tokens, handshakes, or origin checks. Three specific methods — updateOptions(), clearOptions(), and openInEditor() — bypass the ensureDevAuthToken check used by other mutating methods. An attacker can chain updateOptions() to set a malicious command as the editor binary, then trigger openInEditor() to spawn that command as a child process, resulting in arbitrary code execution on the developer's machine. The attack is limited to development mode environments where the HMR port is reachable. The issue has been patched in Nuxt DevTools version 3.3.1. Developers are advised to upgrade immediately to mitigate the risk.