CVE-2025-54782
1 advisory.
npm/@nestjs/devtools-integration CVE-2025-54782: critical, EPSS 53.31%
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
Action: Upgrade @nestjs/devtools-integration to 0.2.1 or later.
npm i @nestjs/devtools-integration@0.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.2.1 | - |
Fixed versions
| 0.2.1 |
Sources
- osv: GHSA-85cg-cmq5-qjm7
- https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
- https://nvd.nist.gov/vuln/detail/CVE-2025-54782
- https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc
- https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration
- https://github.com/nestjs/nest
- https://jlleitschuh.org/nestjs-devtools-integration-rce-poc
- https://nodejs.org/api/vm.html
- https://socket.dev/blog/nestjs-rce-vuln
CVE-2025-54782 · published · modified · JSON