Nx is a monorepo solution for TypeScript and polyglot codebases. From versions 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply '..' segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. This allows the migration archive to write attacker-controlled bytes outside the temporary directory, and opening the destination stream can truncate an existing writable file even if no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations. The vulnerable Nx copy is reached when the normal nx@latest handoff is bypassed with environment variables or fallback after a temporary-install failure. The issue is fixed in versions 22.7.10 and 23.2.1.

An attacker with the ability to influence the migration manifest can cause Nx to write or truncate files outside the intended temporary directory during migration planning. This can lead to unauthorized file modification or data loss. The vulnerability requires local access or the ability to supply a hostile package dependency. The CVSS 4.0 score is 5.8 (medium severity), reflecting limited attack vector (local), low complexity, and partial impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Nx versions 22.7.10 and 23.2.1. Users should upgrade to at least one of these versions to remediate the issue. No additional mitigation is required if these versions are in use. Patch status is confirmed by the vendor advisory.