CVE-2026-48027 describes an incident where a maliciously altered version (18.95.0) of the Nx Console, a user interface for Nx & Lerna, was published and briefly available on Visual Studio Marketplace and OpenVSX. This version contained embedded malicious code, posing a critical security risk. The compromised version was removed quickly, and the vendor has released version 18.100.0 which is not compromised. The vulnerability is categorized as CWE-506, indicating the presence of embedded malicious code within the software package. No official remediation level is stated, but upgrading to version 18.100.0 is the recommended fix.

The presence of embedded malicious code in version 18.95.0 of Nx Console could allow attackers to execute harmful actions on affected systems without user interaction, given the CVSS vector indicates no privileges or user interaction required and high impact on confidentiality, integrity, and availability. The short exposure window limited potential impact. There are no known exploits in the wild reported at this time.

Users should upgrade to Nx Console version 18.100.0, which is confirmed not to be compromised. Since the malicious version was removed quickly, ensuring no installations of version 18.95.0 remain is critical. Patch status is not explicitly stated in the vendor advisory, but the upgrade to 18.100.0 effectively remediates the issue.