CVE-2025-54782 Details
Description
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.
A critical remote code execution vulnerability has been identified in the @nestjs/devtools-integration package, affecting versions through 0.2.0. The vulnerability arises from an unsafe JavaScript sandbox implementation that allows arbitrary code execution on a developer's machine. This issue is exacerbated by missing cross-origin protections, enabling exploitation from malicious websites.
Users are advised to upgrade to version 0.2.1 of the @nestjs/devtools-integration package, which addresses the vulnerability by implementing a safer sandbox, adding origin and content-type validations, and introducing authentication for the devtools connection.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc | [email protected] | Exploit |
| https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration | [email protected] | Product |
| https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7 | [email protected] | ExploitVendor Advisory |
| https://nodejs.org/api/vm.html | [email protected] | Product |
| https://socket.dev/blog/nestjs-rce-vuln | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nestjs devtools-integration | < 0.2.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2025 | Initial Analysis | [email protected] |
| Aug 4, 2025 | CVE Modified | CISA-ADP |
| Aug 2, 2025 | New CVE Received | [email protected] |