CVE-2025-54782: Nestjs Devtools-integration remote code execution (CVSS 8.8)

Description

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Nestjs Devtools-integration< 0.2.1

Remediation

Fixed in

Nestjs Devtools-integration≥ 0.2.1

Patch & vendor advisories

https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7

References

https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-pocExploit
https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integrationProduct
https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7ExploitVendor Advisory
https://nodejs.org/api/vm.htmlProduct
https://socket.dev/blog/nestjs-rce-vulnExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2025-54782 being actively exploited?

CVE-2025-54782 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 52.0%.

How severe is CVE-2025-54782?

CVE-2025-54782 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 52.0% probability of exploitation.

Which products are affected by CVE-2025-54782?

Affected products include Nestjs Devtools-integration.

How do I fix CVE-2025-54782?

Upgrade affected software to a fixed version, for example Nestjs Devtools-integration 0.2.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-54782 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo