## Summary
The local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the `/help` endpoint, which runs a target's configured help command. The practical impact is typically **cross-origin information disclosure**, but can be arbitrary command injection in rare cases.
## Severity
Exploitation requires the developer to be running `nx graph` and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).
## Affected & Patched Versions
Package: `nx` (npm).
- **Affected:** `>= 17.0.4, < 22.7.2` and `>= 23.0.0-beta.0, < 23.0.0-beta.2`
- **Patched:** `22.7.2`+ (backport) and `23.0.0` (first in `23.0.0-beta.2`)
The wildcard CORS header was introduced in `17.0.4`; the `/help` execution endpoint in `19.4.0`. **The `21.x` line is not patched** — `21.x` users should upgrade to `22.7.2` or later.
## Details
`nx graph` starts a local server (default `http://127.0.0.1:4211`). Before the fix, its request handler set a wildcard CORS header on every response:
```ts
res.setHeader('Access-Control-Allow-Origin', '*');
```
The `/help` endpoint runs a target's configured command:
```ts
const command = target.metadata?.help?.command;
return execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();
```
A `GET /help` is a CORS "simple request", so a malicious page could `fetch()` it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.
The command is not attacker-controlled through the request — it comes from the workspace's project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For `/help` to run anything malicious, a target carrying a malicious `help.command` must already exist in the project graph, which can only be introduced by **installing a malicious package** or by **altering the workspace's own code/configuration** — both of which already grant code execution independent of this flaw.
The fix ([#35494](https://github.com/nrwl/nx/pull/35494)) removes the header; the browser's same-origin policy then blocks cross-origin reads.
## References
- Fix: [nrwl/nx#35494](https://github.com/nrwl/nx/pull/35494)
- Introduced: [nrwl/nx#20744](https://github.com/nrwl/nx/pull/20744) (CORS), [nrwl/nx#26629](https://github.com/nrwl/nx/pull/26629) (`/help`)
## Credits
Thanks to Nozomu Sasaki (Paul) ([@morimori-dev](https://github.com/morimori-dev)) for finding and responsibly reporting this issue.
Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by docker-compose.yml, it is reachable from the Appsmith server process itself or a SSRF vulnerability. An authenticated low-privileged user can therefore drive the SSRF to issue POST /load (or any other admin-API call) against http://0.0.0.0:2019/, fully replacing the live Caddy configuration and taking over the reverse proxy. This vulnerability is fixed in 2.1.
Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's intended purpose. The endpoint, /public/modify-subscription, could not change the persisted subscription tier, but it did execute enforcement-related side effects on the caller's own organization, including adjusting team-member enablement state, disabling integrations exceeding the asserted plan's limits, and resetting the scheduled-post cron when the asserted plan was the free tier. Impact is limited to the attacker's own organization and cannot be redirected at other tenants through this endpoint. This issue has been fixed in version 2.21.8.
Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining unauthorized access to camera and microphone permissions.
A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents.
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.
view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted.
Exposed Keycloak management
service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug
information such as metrics and
health data. This issue affects Symmetric Key Agreement Platform: before 26.03.
CVE-2026-33583 is a high-severity vulnerability in the Arqit Symmetric Key Agreement Platform prior to version 26.03. It involves exposure of the QKEY and internal system keys through an unauthenticated and unencrypted HTTP GET method. These keys are critical as they are used in the OTA-Quantum device registration process. The vulnerability allows an attacker to access sensitive cryptographic material without authentication, potentially compromising confidentiality and integrity. No official patch or remediation guidance is currently available. The vulnerability has not been reported as exploited in the wild.
CVE-2026-8108 is a high-severity vulnerability in Fuji Electric Tellus version 5.0.2 where the installation adds a kernel driver that grants all users read and write permissions. This misconfiguration can lead to unauthorized access and modification of kernel-level resources.
CVE-2026-8109 is a medium severity vulnerability in Ivanti Endpoint Manager Core Server versions before 2024 SU6. It involves an exposed dangerous method that allows a remote authenticated attacker to leak access credentials, resulting in a confidentiality breach. The vulnerability does not affect integrity or availability and requires attacker authentication. No official patch or remediation has been confirmed yet, and no exploits are known in the wild.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically read-only. This vulnerability is fixed in 2.6.4.
CVE-2026-3483 is a high-severity vulnerability in Ivanti Desktop and Server Management (DSM) prior to version 2026.1.1. It involves an exposed dangerous method that allows a local authenticated attacker to escalate privileges. The vulnerability requires the attacker to have local access and some level of authentication but does not require user interaction. Exploitation can lead to full compromise of confidentiality, integrity, and availability of affected systems. No known exploits are currently in the wild, but the CVSS score of 7.8 indicates significant risk. Organizations using Ivanti DSM should prioritize patching once updates are available. This vulnerability primarily affects environments where Ivanti DSM is deployed, including enterprise IT management infrastructures.
Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig() via URI handler.
This issue affects RustDesk Client: through 1.4.5.
In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00465314; Issue ID: MSV-4956.
Docker Model Runner versions prior to 1.0.16 expose an unauthenticated POST endpoint that allows attackers with network access to inject arbitrary runtime flags to the underlying inference server. This can be exploited to overwrite arbitrary files accessible to the Model Runner process, including critical Docker Desktop VM disk files, potentially destroying containers, images, volumes, and build history. The vulnerability is fixed in Docker Model Runner 1.0.16 and Docker Desktop 4.61.0. A workaround involves enabling Enhanced Container Isolation to block container access to Model Runner, though certain configurations exposing Model Runner over localhost TCP remain vulnerable.
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.