Nx is a monorepo tool for TypeScript and polyglot codebases. In affected versions (>=20.8.0 <22.7.7 and >=20.8.0 <23.0.2), the self-hosted HTTP remote cache extracts downloaded cache artifacts without restricting file extraction paths. This allows a malicious or on-path attacker controlling the remote cache server to supply a crafted tar archive with entries that escape the cache directory, writing files to arbitrary locations on the host system. This can escalate to remote code execution. The vulnerability does not affect Nx's default local cache or Nx Cloud. The flaw is addressed in versions 22.7.7 and 23.0.2.

An attacker controlling or intercepting the remote cache server can cause arbitrary files to be written outside the intended cache directory on the victim's machine. This can lead to remote code execution, compromising the system running Nx. Only workspaces configured to use a self-hosted remote cache are vulnerable. Default local cache and Nx Cloud users are not impacted.

Upgrade Nx to version 22.7.7 or 23.0.2 or later, where this path traversal vulnerability is fixed. If upgrading immediately is not possible, avoid using self-hosted HTTP remote cache configurations until patched. The default local cache and Nx Cloud do not require action.