CVE-2025-54782— @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
Quick assessment
Affected
nestjs nest
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
nest是nestjs开源的一个 Node.js 框架，用于使用 TypeScript/JavaScript 构建高效、可扩展和企业级的服务器端应用程序。 nest 0.2.0及之前版本存在命令注入漏洞，该漏洞源于@nestjs/devtools-integration包存在不安全JavaScript沙箱，可能导致远程代码执行。
Public Exploits 1
Nuclei · 1
CVE-2025-54782.yaml [template]
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-54782
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers
Source: CVE Program / CVE List V5
Vulnerability Description
Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
nest 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
nest是nestjs开源的一个 Node.js 框架，用于使用 TypeScript/JavaScript 构建高效、可扩展和企业级的服务器端应用程序。 nest 0.2.0及之前版本存在命令注入漏洞，该漏洞源于@nestjs/devtools-integration包存在不安全JavaScript沙箱，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-54782
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54782.yaml | POC Details |
| 2 | NestJS DevTools Unauthenticated RCE | https://github.com/nitrixog/CVE-2025-54782 | POC Details |
| 3 | PoC for CVE-2025-54782 | https://github.com/vxaretra/CVE-2025-54782 | POC Details |
| 4 | CVE-2025-54782 | https://github.com/DDestinys/CVE-2025-54782 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-54782
请登录查看更多情报信息。
Security Blog Posts for CVE-2025-54782 (1)
IV. Related Vulnerabilities
Same product: nest
-
CVE-2026-102281
Nest: Remote process termination via a deeply nested microse -
CVE-2025-36939
Google Nest 缓冲区错误漏洞 -
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash -
CVE-2026-40879
Nest: DoS via Recursive handleData in JsonSocket (TCP Transp -
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Outp
Same vendor: nestjs
-
CVE-2026-102281
Nest: Remote process termination via a deeply nested microse -
CVE-2026-54281
Nest: Middleware Bypass on Fastify via Trailing Slash -
CVE-2026-40879
Nest: DoS via Recursive handleData in JsonSocket (TCP Transp -
CVE-2026-35515
@nestjs/core Improperly Neutralizes Special Elements in Outp -
CVE-2026-33011
Nest Fastify HEAD Request Middleware Bypass
Same weakness: CWE-77
-
CVE-2026-101216
CVE-2026-101216 -
CVE-2026-97781
Microsoft Office OneNote Remote Code Execution Vulnerability -
CVE-2026-96951
Windows Shell Security Feature Bypass Vulnerability -
CVE-2026-69718
Windows Update Elevation of Privilege Vulnerability -
CVE-2026-69370
Visual Studio Code Remote Code Execution Vulnerability
V. Comments for CVE-2025-54782
No comments yet