CVE-2025-54782

A critical remote code execution vulnerability (CVSS 4.0: 9.4) exists in the @nestjs/devtools-integration package for the NestJS Node.js framework in versions 0.2.0 and below. When the Devtools integration is enabled, it adds HTTP endpoints to a locally running NestJS development server, and the /inspector/graph/interact endpoint accepts a JSON 'code' field that is executed inside an improperly isolated Node.js vm.runInNewContext (safe-eval-like) sandbox. Because the local server lacks cross-origin protections (CSRF), any malicious website a developer visits can silently send crafted requests to localhost and execute arbitrary code on that machine with the privileges of the development server process. Only developers actively running the local NestJS development server with this dev-only package enabled are affected; production applications are not exposed unless the dev server is running. A public proof-of-concept and the vendor advisory (GHSA-85cg-cmq5-qjm7) are available; exploitation is not yet confirmed in the wild, but EPSS assigns a high 49.2% probability of exploitation within 30 days.

What to do: Upgrade @nestjs/devtools-integration to version 0.2.1 or later. Until upgraded, disable the Devtools integration or avoid browsing untrusted websites while the local development server is running, and audit which developer machines have the integration enabled. Because the attack is a drive-by browser request to localhost, treat any workstation that ran the vulnerable dev server with Devtools enabled as potentially compromised and review for suspicious processes or changes.