{"action":"Upgrade @nestjs/devtools-integration to 0.2.1 or later.","affected":[{"fixed":"0.2.1","introduced":"0"}],"component":"@nestjs/devtools-integration","cve_ids":["CVE-2025-54782"],"ecosystem":"npm","epss":0.53307,"exploited":false,"fixed_versions":["0.2.1"],"ghsa_id":"GHSA-85cg-cmq5-qjm7","id":"tcs_01M5KFBVPXC4ZEAS6ZYP307K87","modified_at":"2025-08-04T15:28:48Z","published_at":"2025-08-01T18:43:13Z","references":["https://osv.dev/vulnerability/GHSA-85cg-cmq5-qjm7","https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7","https://nvd.nist.gov/vuln/detail/CVE-2025-54782","https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc","https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration","https://github.com/nestjs/nest","https://jlleitschuh.org/nestjs-devtools-integration-rce-poc","https://nodejs.org/api/vm.html","https://socket.dev/blog/nestjs-rce-vuln"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-85cg-cmq5-qjm7","url":"https://osv.dev/vulnerability/GHSA-85cg-cmq5-qjm7"},{"source":"nvd","source_id":"CVE-2025-54782","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54782"}],"summary":"@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers"}