PT-2025-31707

CVE-2025-54782

Published

2025-08-01

Updated

2025-10-09

Description by

CVSS 4.0

9.4

Critical

MetricsAV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions

@nestjs/devtools-integration versions 0.2.0 and below

Description

A critical Remote Code Execution (RCE) vulnerability exists in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox implementation. Due to improper sandboxing and missing cross-origin protections, a malicious website visited by a developer can execute arbitrary code on their local machine. The vulnerable endpoint, /inspector/graph/interact, accepts JSON input containing a code field, which is then executed in a Node.js vm.runInNewContext sandbox. The sandbox implementation is similar to the abandoned safe-eval library and is easily escapable. The server lacks proper CORS/Origin checking, allowing attackers to bypass security measures.

Recommendations

Update to version 0.2.1 or later.

Exploitability

Exploit

Fix

Impacts