Name of the Vulnerable Software and Affected Versions:

Nest versions 0.2.0 and below

Description:

Nest is a framework for building scalable Node.js server-side applications. A critical Remote Code Execution (RCE) vulnerability exists in the `@nestjs/devtools-integration` package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox. Due to improper sandboxing and missing cross-origin protections, a malicious website visited by a developer can execute arbitrary code on their local machine. The `/inspector/graph/interact` endpoint accepts JSON input containing a `code` field and executes the provided code in a Node.js `vm.runInNewContext` sandbox.

Recommendations:

Update to Nest version 0.2.1 or later.