CVE-2026-71476: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in nrwl nx
Nx versions from 20.8.0 until 22.7.7 and 23.0.2 contain a path traversal vulnerability in the self-hosted HTTP remote cache feature. This flaw allows a malicious or man-in-the-middle remote cache server to craft a tar archive that writes files outside the intended cache directory, potentially leading to remote code execution. The default local cache and Nx Cloud are not affected. The vulnerability is fixed in versions 22.7.7 and 23.0.2.
AI Analysis
Technical Summary
Nx, a monorepo solution for TypeScript and polyglot codebases, has a path traversal vulnerability (CWE-22) in its self-hosted HTTP remote cache feature. From versions 20.8.0 up to but not including 22.7.7 and 23.0.2, the cache extraction process does not properly constrain file extraction paths, allowing crafted tar archives to escape the cache directory and write arbitrary files on the host system. This can be exploited by a malicious or on-path attacker controlling the remote cache server, potentially escalating to remote code execution. The default local cache and Nx Cloud are unaffected. The issue is resolved in versions 22.7.7 and 23.0.2.
Potential Impact
An attacker controlling or intercepting the self-hosted remote cache server can deliver malicious tar archives that write files outside the intended cache directory, leading to arbitrary file write on the victim machine. This can escalate to remote code execution, posing a high security risk. Only workspaces using self-hosted remote cache are affected; default local cache and Nx Cloud users are not impacted.
Mitigation Recommendations
This vulnerability is fixed in Nx versions 22.7.7 and 23.0.2. Users should upgrade to one of these versions or later to remediate the issue. Workspaces using the default local cache or Nx Cloud are not affected and require no action. Since no official patch links or advisories are provided, users should verify upgrade availability from the vendor's official sources.
CVE-2026-71476: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in nrwl nx
Description
Nx versions from 20.8.0 until 22.7.7 and 23.0.2 contain a path traversal vulnerability in the self-hosted HTTP remote cache feature. This flaw allows a malicious or man-in-the-middle remote cache server to craft a tar archive that writes files outside the intended cache directory, potentially leading to remote code execution. The default local cache and Nx Cloud are not affected. The vulnerability is fixed in versions 22.7.7 and 23.0.2.
CVSS v4.0
Score 8.7high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Nx, a monorepo solution for TypeScript and polyglot codebases, has a path traversal vulnerability (CWE-22) in its self-hosted HTTP remote cache feature. From versions 20.8.0 up to but not including 22.7.7 and 23.0.2, the cache extraction process does not properly constrain file extraction paths, allowing crafted tar archives to escape the cache directory and write arbitrary files on the host system. This can be exploited by a malicious or on-path attacker controlling the remote cache server, potentially escalating to remote code execution. The default local cache and Nx Cloud are unaffected. The issue is resolved in versions 22.7.7 and 23.0.2.
Potential Impact
An attacker controlling or intercepting the self-hosted remote cache server can deliver malicious tar archives that write files outside the intended cache directory, leading to arbitrary file write on the victim machine. This can escalate to remote code execution, posing a high security risk. Only workspaces using self-hosted remote cache are affected; default local cache and Nx Cloud users are not impacted.
Mitigation Recommendations
This vulnerability is fixed in Nx versions 22.7.7 and 23.0.2. Users should upgrade to one of these versions or later to remediate the issue. Workspaces using the default local cache or Nx Cloud are not affected and require no action. Since no official patch links or advisories are provided, users should verify upgrade availability from the vendor's official sources.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-06T19:56:23.724Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a75070fbf8831d5395f5df2
Added to database: 08/06/2026, 22:13:35 UTC
Last enriched: 08/06/2026, 22:26:42 UTC
Last updated: 08/07/2026, 02:06:01 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.