CVE-2026-104854
HighCVSS 8.5Summary
Nx from 14.6.0 until 22.7.9 and 23.1.2 creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only permissions. Another unprivileged local account can connect to a running socket because the transport performs no authentication. The daemon's PROCESS_IN_BACKGROUND request can execute code as the account running Nx. Fixed in versions 22.7.9 and 23.1.2.
Risk Assessment
A local attacker on shared servers or containers can execute code in the context of the Nx user, access workspace file contents, project graphs, and task hashes, threatening confidentiality and integrity.
Recommendation
Upgrade Nx to version 22.7.9 or 23.1.2 and ensure proper permissions on temporary directories.
Other vulnerabilities in Nx
See all- CVE-2026-104853Medium
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile dependency can supply .. segments or an absolute path, causing the migration archive to write attacker-controlled bytes outside the temporary directory or truncate an existing writable file.
- CVE-2026-71476High
Vulnerability in Nx (versions 20.8.0 to 22.7.7 and 23.0.2) in the self-hosted HTTP remote cache. A malicious cache server can return a crafted tar archive that writes files outside the cache directory, potentially leading to remote code execution.
Original NVD description (English source)
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS