Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@nestjs/devtools-integration

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4npmAmendedPublished

    @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

    CVE-2025-54782 · GHSA-85cg-cmq5-qjm7

    Affected
    • npm @nestjs/devtools-integration <= 0.2.0
    Fixed in
    0.2.1· Vendor fix available
    Issue
    A critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. A full blog post about how this vulnerability was uncovered can be found on Socket's blog. Details The @nestjs/devtools-integration package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. Key issues: 1. Unsafe Sandbox: The sandbox implementation closely resembles the abandoned safe-eval library. The Node.js vm module is explicitly documented as not providing a security…

    Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →