Executive brief
The @nestjs/devtools-integration package adds a local development server used by JavaScript developers running NestJS. A malicious website can exploit a sandboxing flaw and missing security checks in one of its HTTP endpoints to execute arbitrary code on a developer's computer, potentially compromising their entire system and any projects they're working on.
Technical details
The vulnerability is a sandbox escape combined with missing CORS validation in the @nestjs/devtools-integration package. The /inspector/graph/interact endpoint uses Node.js vm.runInNewContext with an inadequate sandbox that attempts to block Function constructors but can be trivially escaped using known techniques. The endpoint accepts POST requests with JSON containing a code field and does not validate the request's Origin or Content-Type, allowing cross-origin requests via HTML forms or XHR with text/plain content type to bypass CORS preflight checks. An attacker can host a malicious website that, when visited by a developer with the devtools server running, sends a crafted POST request containing JavaScript code that escapes the sandbox and executes arbitrary commands (e.g., via child_process.execSync). Patches are available in version 0.2.1 and later.
Affected products
- NestJS devtools-integration <=0.2.0
Timeline
- 2025-08-01: disclosed