Nest - RCE (CVE-2025-54782)

CVE-2025-54782 is a critical remote code execution vulnerability in the @nestjs/devtools-integration package for NestJS, affecting versions 0.2.0 and below. This flaw allows any malicious website visited by a developer to execute arbitrary code on their local machine via an unsafe API endpoint exposed by the development server, due to improper sandboxing and missing cross-origin protections. Attackers can exploit this vulnerability to fully compromise the affected system, making it a significant risk for developers using vulnerable versions.

CrowdSec has been tracking this vulnerability and its exploits since 13th of August 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-54782 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-54782 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-54782 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit the /inspector/graph/interact endpoint by sending JSON payloads containing malicious JavaScript code in the code field, enabling remote code execution on vulnerable NestJS development servers. This endpoint is exposed by the @nestjs/devtools-integration package when running in development mode.