# CVE-2025-54782: Nest - RCE

> Live exploitation tracking for CVE-2025-54782 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-54782

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** NestJS Nest
- **Weaknesses:** CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')); CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')); CWE-352 (Cross-Site Request Forgery (CSRF))
- **Tags:** web_application

## Description

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (safe-eval-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine. The package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, /inspector/graph/interact, accepts JSON input containing a code field and executes the provided code in a Node.js vm.runInNewContext sandbox. This is fixed in version 0.2.1.

## CrowdSec analysis

[CVE-2025-54782](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-54782) is a critical remote code execution vulnerability in the @nestjs/devtools-integration package for NestJS, affecting versions 0.2.0 and below. This flaw allows any malicious website visited by a developer to execute arbitrary code on their local machine via an unsafe API endpoint exposed by the development server, due to improper sandboxing and missing cross-origin protections. Attackers can exploit this vulnerability to fully compromise the affected system, making it a significant risk for developers using vulnerable versions.

CrowdSec has been tracking this vulnerability and its exploits since 13th of August 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-54782 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-54782 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-54782 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit the `/inspector/graph/interact` endpoint by sending JSON payloads containing malicious JavaScript code in the code field, enabling remote code execution on vulnerable NestJS development servers. This endpoint is exposed by the @nestjs/devtools-integration package when running in development mode.

## Timeline

- 2025-08-01: CVE Published. CVE-2025-54782 is published to NVD.
- 2025-08-13: Rule Released. CrowdSec releases a rule to detect CVE-2025-54782 exploitation attempts against the CrowdSec Network.
- 2025-08-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-54782 for the first time.

## References

- https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7
- https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration
- https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc
- https://nodejs.org/api/vm.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54782.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-54782) follows observed exploitation activity for CVE-2025-54782. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.