CVE-2026-48027 identifies a supply chain compromise where version 18.95.0 of the Nx Console, a user interface for Nx & Lerna, was published with embedded malicious code. The malicious version was available for approximately 18 minutes in the Visual Studio Marketplace and about 36 minutes in OpenVSX before removal. The vendor has released version 18.100.0 which is not compromised. No official remediation level or patch advisory is provided, but upgrading to 18.100.0 is the recommended fix.

Users who installed version 18.95.0 of Nx Console during the brief window of availability were exposed to embedded malicious code, which could lead to compromise depending on the nature of the malicious payload. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Users should immediately verify their Nx Console version and upgrade to version 18.100.0 or later, which is confirmed not to be compromised. Since the malicious version was removed quickly, users who did not install 18.95.0 are not affected. No other official remediation or temporary fix is documented.