References https://nvd.nist.gov/vuln/detail/CVE-2025-54782 https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7 https://socket.dev/blog/nestjs-rce-vuln https://github.com/JLLeitschuh/nestjs-devtools-integration-rce-poc https://access.redhat.com/security/cve/cve-2025-54782 https://www.sentinelone.com/vulnerability-database/cve-2025-54782/ https://linuxsecurity.com/news/security-vulnerabilities/critical-nestjs-rce-vulnerability https://security.snyk.io/vuln/SNYK-JS-NESTJSDEVTOOLSINTEGRATION-11417395 https://www.tenable.com/cve/CVE-2025-54782 https://www.anquanke.com/post/id/310849 https://avd.aliyun.com/detail?id=AVD-2025-54782 https://cn-sec.com/archives/4621870.html
Related Vulnerabilities(CVE-2025-61882)Oracle Concurrent Processing BI Publisher Integration 远程接管漏洞NestJS DevTools Integration interact 存在远程代码执行漏洞(CVE-2025-54782)PoCCVE-2022-26148: Grafana & Zabbix Integration - Credentials DisclosurePoCCVE-2023-5003: Active Directory Integration WP Plugin < 4.1.10 - Log DisclosurePoCCVE-2025-54782: NestJS DevTools Integration - Remote Code ExecutionPoCcloudtrail-integrated-cloudwatch: CloudTrail CloudWatch IntegrationPoCazure-aks-entra-id-unintegrated: Azure AKS Microsoft Entra ID Integration Not ConfiguredPoCazure-functionapp-appinsights-missing: Application Insights Integration for Azure Function AppsPoCazure-functionapp-vnet-integration-missing: Virtual Network Integration for Azure Functions Not EnabledPoCnode-integration-enabled: Electron Applications - Cross-Site Scripting & Remote Code ExecutionPoCwebmethod-integration-default-login: WebMethod Integration Server Default LoginPoCspringboot-integrationgraph: Springboot Actuator integrationgraph