Nx, a monorepo tool for TypeScript and polyglot codebases, improperly manages privileges by creating Unix domain sockets in shared temporary directories without restricting permissions to the owner. This allows local unprivileged users on multi-user systems to discover and connect to these sockets, which lack authentication. Through the daemon's PROCESS_IN_BACKGROUND request, an attacker can execute arbitrary code as the Nx process user by supplying a malicious module path. Other handlers may expose sensitive workspace data such as file contents, project graphs, and task hashes. The issue affects versions >=14.6.0 <22.7.9 and >=23.0.0 <23.1.2 and is resolved in 22.7.9 and 23.1.2.

Local unprivileged users on shared build servers, developer hosts, or multi-user containers can exploit this vulnerability to execute arbitrary code with the privileges of the Nx process user. Additionally, they may access sensitive workspace information including file contents, project graphs, and task hashes. Single-user machines without other local accounts are not affected. This elevates the risk of unauthorized code execution and data exposure within affected environments.

Upgrade Nx to versions 22.7.9 or 23.1.2 where this vulnerability is fixed. Disabling the daemon alone is insufficient as plugin-worker sockets remain vulnerable. Ensure that the environment is not shared with untrusted local users to reduce exposure until patched.