CVE-2025-54782criticalobserved exploitationCWE-352CWE-77CWE-78

CVE-2025-54782: critical vulnerability in nestjs nest

@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

Published · Updated

Follow this CVE+ Monitor nest.js+ Monitor @nestjs/devtools-integration

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

97Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.4epss 47%
from disclosure to weaponsame day
Published on NVDAug 1
1st PoCJul 25
VulnCheck+17d
In short

A development tool for NestJS runs unsafe code on developers' machines when they visit malicious websites. An attacker can execute arbitrary commands on a developer's computer by tricking them into visiting a crafted webpage while the tool is active.

Technical detail

The @nestjs/devtools-integration package exposes a local HTTP endpoint (/inspector/graph/interact) that executes user-supplied JavaScript in a weak sandbox (vm.runInNewContext) without CSRF protection. A malicious website can send cross-origin requests to execute arbitrary Node.js code in the developer's local environment, achieving RCE via the lack of origin validation and insufficient isolation.

Summary generated and translated by AI from the official description.
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
nestjs · nest
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — nestjs nest

In the same product, most dangerous first.

CVE-2026-102281HIGHNest: Remote process termination via a deeply nested microservice message patternEPSS 0.6%CVE-2026-54281HIGHNest: Middleware Bypass on Fastify via Trailing SlashEPSS 0.5%CVE-2025-69211MEDIUMNest has a Fastify URL Encoding Middleware Bypass (TOCTOU)EPSS 0.4%CVE-2026-33011HIGHNest Fastify HEAD Request Middleware BypassEPSS 0.4%CVE-2026-40879HIGHNest: DoS via Recursive handleData in JsonSocket (TCP Transport)EPSS 0.3%CVE-2026-35515MEDIUM@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')EPSS 0.2%