CVE-2025-54782HIGH 8.8EPSS p98.7%

CVE-2025-54782CVE-2025-54782

Description

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.

Scoring

CVSS 3.18.8 (HIGH)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS46.17% probability of exploitation · percentile 98.7% · 2026-06-18T12:00:27Z
Published2025-08-02
Last modified2025-10-09

Underlying weaknesses· 3

CWE-77CWE-78CWE-352

References

  1. https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc
  2. https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration
  3. https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
  4. https://nodejs.org/api/vm.html
  5. https://socket.dev/blog/nestjs-rce-vuln
  6. https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7

3

TypeTargetConfidenceTier
WeaknessCross-Site Request Forgery (CSRF)cwe-3520%live
WeaknessImproper Neutralization of Special Elements used in a Command ('Command Injection')cwe-770%live
WeaknessImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')cwe-780%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
Meta React Server Components Remote Code Execution Vulnerability
CVE
CVE-2026-2293
CVE
CVE-2026-27597
CVE
CVE-2026-44007
CVE
CVE-2026-49143
CVE
CVE-2026-24781
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.