PT-2025-31707 · Unknown+1 · @Nestjs/Devtools-Integration+1

Jlleitschuh · Published 2025-08-01 · Updated 2025-10-09 · CVE-2025-54782

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions

@nestjs/devtools-integration versions 0.2.0 and below

Description

A critical Remote Code Execution (RCE) vulnerability exists in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox implementation. Due to improper sandboxing and missing cross-origin protections, a malicious website visited by a developer can execute arbitrary code on their local machine. The vulnerable endpoint, /inspector/graph/interact, accepts JSON input containing a code field, which is then executed in a Node.js vm.runInNewContext sandbox. The sandbox implementation is similar to the abandoned safe-eval library and is easily escapable. The server lacks proper CORS/Origin checking, allowing attackers to bypass security measures.

Recommendations

Update to version 0.2.1 or later.

Exploit

Fix

RCE

Command Injection

CSRF

OS Command Injection

Weakness Enumeration

CWE-77

CWE-352

CWE-78

Related Identifiers

BDU:2025-13414

CVE-2025-54782

GHSA-85CG-CMQ5-QJM7

Affected Products

@Nestjs/Devtools-Integration

Nest

References · 33

• 🔥 https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54782.json · Exploit
• 🔥 https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc · Exploit
• 🔥 https://socket.dev/blog/nestjs-rce-vuln · Exploit
• https://bdu.fstec.ru/vul/2025-13414 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54782 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54782 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85cg-cmq5-qjm7 · Vendor Advisory
• https://github.com/nestjs/nest · Note
• https://reddit.com/r/CVEWatch/comments/1mi5527/top_10_trending_cves_05082025 · Reddit Post
• https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration · Note
• https://twitter.com/Andrewkek77/status/1952095643985682765 · Twitter Post
• https://twitter.com/CloudflareHelp/status/1953029745370681516 · Twitter Post
• https://twitter.com/Komodosec/status/1964814731006693817 · Twitter Post
• https://twitter.com/3duserinterface/status/1958317742165016675 · Twitter Post