CVE-2025-54782
BaseFortify
Publication date: 2025-08-02
Last updated on: 2025-10-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nestjs | devtools-integration | to 0.2.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a critical Remote Code Execution (RCE) issue in the @nestjs/devtools-integration package of the Nest framework (versions 0.2.0 and below). The package exposes a local development HTTP server with an API endpoint that executes code inside an unsafe JavaScript sandbox. Due to improper sandboxing and missing cross-origin protections, a malicious website visited by a developer can execute arbitrary code on their local machine through this endpoint. The vulnerability is fixed in version 0.2.1.
How can this vulnerability impact me? :
If you use the vulnerable versions of the @nestjs/devtools-integration package, an attacker can execute arbitrary code on your local machine by tricking you into visiting a malicious website. This can lead to full compromise of your development environment, data loss, or unauthorized access to sensitive information.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the @nestjs/devtools-integration package to version 0.2.1 or later, as this version contains the fix for the critical Remote Code Execution vulnerability. Additionally, avoid enabling the vulnerable package in production or on systems exposed to untrusted networks or websites.