CVE-2025-54782
📋 TL;DR
A critical Remote Code Execution vulnerability in @nestjs/devtools-integration package allows malicious websites to execute arbitrary code on a developer's local machine when they have the vulnerable package enabled. This affects developers using NestJS framework versions 0.2.0 and below with the devtools integration enabled. The vulnerability stems from improper sandboxing in a local development HTTP server endpoint.
💻 Affected Systems
- @nestjs/devtools-integration
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of developer workstation leading to lateral movement, credential theft, and deployment of persistent malware.
Likely Case
Local machine compromise allowing attacker to steal sensitive development data, credentials, and access internal resources.
If Mitigated
Limited impact if proper network segmentation and developer workstation security controls are implemented.
🎯 Exploit Status
Exploitation requires developer to visit malicious website while vulnerable devtools server is running locally.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.1
Vendor Advisory: https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
Restart Required: Yes
Instructions:
1. Update package.json to specify @nestjs/devtools-integration version 0.2.1 or higher. 2. Run npm update @nestjs/devtools-integration. 3. Restart development server.
🔧 Temporary Workarounds
Disable devtools integration
allTemporarily disable the vulnerable devtools integration package
npm uninstall @nestjs/devtools-integration
Network isolation
allRun development server on isolated network or localhost-only binding
nest start --host 127.0.0.1
🧯 If You Can't Patch
- Disable devtools integration completely in development environments
- Implement strict browser security policies and network segmentation for developer workstations
🔍 How to Verify
Check if Vulnerable:
Check package.json for @nestjs/devtools-integration version <=0.2.0 and verify devtools are enabledCheck Version:
npm list @nestjs/devtools-integrationVerify Fix Applied:
Verify @nestjs/devtools-integration version is 0.2.1 or higher in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /inspector/graph/interact endpoint
- Suspicious code execution patterns in development server logs
Network Indicators:
- HTTP POST requests to local development server on unusual ports
- Cross-origin requests to localhost from external sources
SIEM Query:
source="nest-dev-server" AND (uri="/inspector/graph/interact" OR method="POST")🔗 References
- https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc
- https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration
- https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
- https://nodejs.org/api/vm.html
- https://socket.dev/blog/nestjs-rce-vuln
- https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
