{"advisories":[{"id":"EUVD-2025-23413","source":"euvd","title":"@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23413"},{"id":"GHSA-85cg-cmq5-qjm7","source":"ghsa","title":"@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers","url":"https://github.com/advisories/GHSA-85cg-cmq5-qjm7"}],"cve":"CVE-2025-54782","enrichment":{"created":"2025-08-05T11:39:04.143848+00:00","updated":"2025-08-05T11:39:04.143935+00:00","vendors":["nestjs","nestjs$PRODUCT$devtools-integration"]},"epss":{"score":0.51324},"mitre":{"cpes":[],"created":"2025-08-01T23:36:58.421000+00:00","description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"mitre_repo_path":"cves/2025/54xxx/CVE-2025-54782.json","references":["https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc","https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration","https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7","https://nodejs.org/api/vm.html","https://socket.dev/blog/nestjs-rce-vuln"],"title":"@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers","updated":"2025-08-04T15:23:30.116000+00:00","vendors":[],"weaknesses":["CWE-352","CWE-77","CWE-78"]},"nvd":{"cpes":["cpe:2.3:a:nestjs:devtools-integration:*:*:*:*:*:node.js:*:*"],"created":"2025-08-02T00:15:25.953000+00:00","description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2025/CVE-2025-54782.json","references":["https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc","https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration","https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7","https://nodejs.org/api/vm.html","https://socket.dev/blog/nestjs-rce-vuln"],"title":null,"updated":"2026-06-17T09:40:41.643000+00:00","vendors":["nestjs","nestjs$PRODUCT$devtools-integration"],"weaknesses":["CWE-352","CWE-77","CWE-78"]},"opencve":{"changes":[{"created":"2025-08-02T00:00:00+00:00","data":[{"details":{"new":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.","old":null},"type":"description"},{"details":{"new":"@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers","old":null},"type":"title"},{"details":{"added":["CWE-352","CWE-77","CWE-78"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc","https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration","https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7","https://nodejs.org/api/vm.html","https://socket.dev/blog/nestjs-rce-vuln"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"6f115288-5645-463b-b36e-fdd9d5e248ea"},{"created":"2025-08-04T16:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"51cfbcdf-780c-48bf-8ec8-a1184840390f"},{"created":"2025-08-05T11:45:00+00:00","data":[{"details":["nestjs","nestjs$PRODUCT$devtools-integration"],"type":"first_time"},{"details":{"added":["nestjs","nestjs$PRODUCT$devtools-integration"],"removed":[]},"type":"vendors"}],"id":"5c4fe433-8db3-4556-a1df-9b04aecfca26"},{"created":"2025-10-09T17:45:00+00:00","data":[{"details":{"added":["cpe:2.3:a:nestjs:devtools-integration:*:*:*:*:*:node.js:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":{"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"33900fc8-6000-47ac-ab1b-16197ca40c6f"}],"cpes":{"data":["cpe:2.3:a:nestjs:devtools-integration:*:*:*:*:*:node.js:*:*"],"providers":["nvd"]},"created":{"data":"2025-08-01T23:36:58.421000+00:00","provider":"mitre"},"description":{"data":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},"provider":"mitre"},"epss":{"data":{"score":0.51324},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc","https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration","https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7","https://nodejs.org/api/vm.html","https://socket.dev/blog/nestjs-rce-vuln"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":"@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers","provider":"mitre"},"updated":{"data":"2025-10-09T17:31:16.827000+00:00","provider":"nvd"},"vendors":{"data":["nestjs","nestjs$PRODUCT$devtools-integration"],"providers":["nvd","enrichment"]},"weaknesses":{"data":["CWE-352","CWE-77","CWE-78"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2025-08-01T23:36:58.421000+00:00","description":"Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"poc","Technical Impact":"total"},"version":"2.0.3"}},"references":["https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7"],"title":"@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers","updated":"2025-08-04T15:23:18.309000+00:00","vendors":[],"vulnrichment_repo_path":"2025/54xxx/CVE-2025-54782.json","weaknesses":[]}}