Is CVE-2025-54782 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54782 being exploited in the wild.

How severe is CVE-2025-54782?

Medium severity, with a CVSS score of 4, published 1 August 2025.

Which products and versions are affected?

NestJS Devtools-Integration <=0.2.0; @nestjs/devtools-integration (npm) SEMVER:introduced=0,fixed=0.2.1.

Is there a fix for CVE-2025-54782?

Yes. @nestjs/devtools-integration (npm): upgrade to 0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-54782 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2025-54782?

Check whether you run NestJS Devtools-Integration or @nestjs/devtools-integration (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54782: NestJS devtools-integration sandbox escape and RCE

Q: Is there a fix for CVE-2025-54782?

Yes. @nestjs/devtools-integration (npm): upgrade to 0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-54782 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2025-54782?

Check whether you run NestJS Devtools-Integration or @nestjs/devtools-integration (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54782 · Severity: medium · CVSS 4 · Published 2025-08-01

The @nestjs/devtools-integration package adds a local development server used by JavaScript developers running NestJS. A malicious website can exploit a sandboxing flaw and missing security checks in one of its HTTP endpoints to execute arbitrary code on a developer's computer, potentially compromising their entire system and any projects they're working on.

Vendors: NestJS, npm.

Quick answers

Is CVE-2025-54782 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54782 being exploited in the wild.
How severe is CVE-2025-54782?: Medium severity, with a CVSS score of 4, published 1 August 2025.
Which products and versions are affected?: NestJS Devtools-Integration <=0.2.0; @nestjs/devtools-integration (npm) SEMVER:introduced=0,fixed=0.2.1.
Is there a fix for CVE-2025-54782?: Yes. @nestjs/devtools-integration (npm): upgrade to 0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54782 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2025-54782?: Check whether you run NestJS Devtools-Integration or @nestjs/devtools-integration (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nestjs/devtools-integration (npm): upgrade to 0.2.1 or later
```
npm install @nestjs/devtools-integration@0.2.1
```

Technical details

The vulnerability is a sandbox escape combined with missing CORS validation in the @nestjs/devtools-integration package. The /inspector/graph/interact endpoint uses Node.js vm.runInNewContext with an inadequate sandbox that attempts to block Function constructors but can be trivially escaped using known techniques. The endpoint accepts POST requests with JSON containing a code field and does not validate the request's Origin or Content-Type, allowing cross-origin requests via HTML forms or XHR with text/plain content type to bypass CORS preflight checks. An attacker can host a malicious website that, when visited by a developer with the devtools server running, sends a crafted POST request containing JavaScript code that escapes the sandbox and executes arbitrary commands (e.g., via child_process.execSync). Patches are available in version 0.2.1 and later.

Affected products

NestJS devtools-integration <=0.2.0

Identifiers

CVE-2025-54782
GHSA-85cg-cmq5-qjm7

Timeline

2025-08-01: disclosed

References

https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.