romancortes

🚨 New critical vuln discovered in NestJS Devtools → Full RCE via the browser 😱 All you have to do is… visit a website. 🧵 Here’s how we went from “harmless dev tool” to “pop calc on your Mac”: @​nestjs/devtools-integration ships with a local HTTP server that accepts POST requests to /inspector/graph/interact That endpoint? It executes arbitrary JS using a “sandbox” 🤡 built on safe-eval — which is hilariously named. The sandbox uses vm.runInNewContext() — even though NodeJS explicitly says this is not a security mechanism. This means you can break out of it. And we did. Just needed a tiny payload to escape and run shell commands. But the real magic? You can trigger this from any website, thanks to a CSRF bypass trick using text/plain form posts. The result? Remote Code Execution just by visiting a webpage. No clicking required. We responsibly disclosed this to the NestJS team — they fixed it fast and with grace. Props to them 👏 🎯 CVE-2025-54782 📎 GHSA-85cg-cmq5-qjm7 🔍 Found via @SocketSecurity's AI-driven malware detection Full write-up (including POC): socket.dev/blog/nestjs-rce-v… This is why you don’t run “devtools” that parse and exec random JSON from localhost. Especially not using safe-eval.