Cloudanix VulnDB

CVE-2025-54782

None

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

CVSS

—

EPSS

53.3%

Published

Aug 1, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Attend

A flaw in a development tool lets attackers take control of a programmer's computer just by getting them to visit a bad website.

Weaponized
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
CSRF
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Remote code execution via unsafe JavaScript sandbox in a local development HTTP server exposed by the devtools-integration package, combined with missing cross-origin protections allowing any website to trigger code execution.

Why it matters to the business

Developers using affected systems can have their local machines compromised by visiting malicious websites, leading to potential data theft, malware installation, or further network pivoting. High and rising EPSS with weaponized exploit increases risk of targeted attacks on development environments despite not being listed in KEV.

How an attack unfolds

An attacker hosts a malicious website that leverages the CSRF weakness and improper sandboxing when a developer with the local dev server active visits it, resulting in arbitrary code execution on the developer's machine. Weaponized exploit maturity and EPSS trend upward indicate active exploitation potential.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0, linux-lts (Alpaquita:23) to 6.1.89-r0, and linux-lts (Alpaquita:25) to 6.12.41-r0. Disable the devtools-integration feature when not required for development.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed versions for each Alpaquita stream; confirm the local development server is not exposed or that cross-origin and sandbox protections are enforced.

Typical attack path

  1. Developer runs affected package exposing local HTTP server with unsafe sandbox endpoint
  2. Attacker lures developer to malicious website via phishing or compromised page
  3. Website makes cross-origin request abusing missing protections to invoke sandbox
  4. Unsafe eval executes attacker-controlled JavaScript achieving RCE on local system

How to detect it

Review local development server logs for unexpected API calls to sandbox endpoints, monitor for new processes or network activity originating from the dev server process, and inspect browser history or proxy logs around time of suspected compromise.

  • devtools-integration sandbox endpoint access
  • safe-eval like execution patterns in nestjs dev server
  • cross-origin requests to localhost dev ports from external sites

What your security team should do

  • Apply the exact fixed versions immediately given weaponized status and 424 days since publication
  • Disable or remove @nestjs/devtools-integration in all development workflows
  • Monitor EPSS trend and block known malicious sites targeting developers
  • Educate developers on risks of running local dev servers while browsing

The record

A critical Remote Code Execution (RCE) vulnerability was discovered in the `@nestjs/devtools-integration` package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (`safe-eval`-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. A full blog post about how this vulnerability was uncovered can be found on [Socket's blog](https://socket.dev/blog/nestjs-rce-vuln).

Affected packages

Ecosystem Package Introduced Fixed
npm @nestjs/devtools-integration 0 0.2.1

Related vulnerabilities