---
title: "CVE-2025-54782: @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers"
url: https://erroneo.us/security/cve/CVE-2025-54782/
description: "CVE-2025-54782 (@nestjs/devtools-integration (npm)): Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-08-01
date_modified: 2025-08-04
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-54782"
kev: false
cvss: 9.4
epss: 0.52014
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-54782: @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 52.0% , percentile 99: FIRST’s model estimates a 52.0% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes @nestjs/devtools-integration (npm) <= 0.2.0, fixed in 0.2.1 . Check your lockfile, including transitive dependencies.

## What it is

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.

## Affected packages

- npm `@nestjs/devtools-integration` <= 0.2.0 → fixed: 0.2.1

## Affected products (CVE record)

- nestjs nest: < 0.2.1

## Severity

- GitHub_M CVSS 4.0: 9.4 `CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 52.01% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [GitHub Advisory GHSA-85cg-cmq5-qjm7](https://github.com/advisories/GHSA-85cg-cmq5-qjm7)
- [CVE.org record CVE-2025-54782](https://www.cve.org/CVERecord?id=CVE-2025-54782)
- [NVD entry CVE-2025-54782](https://nvd.nist.gov/vuln/detail/CVE-2025-54782)
- [github.com](https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7)
- [github.com](https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc)
- [github.com](https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration)
- [nodejs.org](https://nodejs.org/api/vm.html)
- [socket.dev](https://socket.dev/blog/nestjs-rce-vuln)
- [jlleitschuh.org](https://jlleitschuh.org/nestjs-devtools-integration-rce-poc)

---
Source page: https://erroneo.us/security/cve/CVE-2025-54782/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt