Threats affecting pkg:brew/nx

Nx versions from 14.0.0 up to but not including 22.7.8, and from 23.0.0 up to but not including 23.1.1, contain a command injection vulnerability. This occurs because Nx builds shell command strings with untrusted git revision or branch name values interpolated directly, allowing an attacker controlling repository content to execute arbitrary commands on machines running Nx commands like 'nx affected' or 'nx import'. The vulnerability is particularly serious in CI environments where these commands run automatically. Fixed in versions 22.7.8 and 23.1.1.

Nx daemon and plugin worker sockets are created in a shared temporary directory with default permissions, allowing any local user on the same machine to connect to them. This can lead to code execution inside the daemon process by sending a specially crafted request. The vulnerability affects multi-user environments such as shared build servers or containers with multiple user accounts. Single-user machines are not affected. Versions from 14.6.0 up to but not including 22.7.9, and from 23.0.0 up to but not including 23.1.2 are vulnerable. Upgrading to 22.7.9 or 23.1.2 or later mitigates the issue.

CVE-2026-104853 is a path traversal vulnerability in the nx tool's migrate command. It occurs because the migration file path from a package manifest is not validated, allowing extraction outside the intended temporary directory. This can lead to attacker-controlled file writes or truncation of files writable by the user, potentially enabling code execution if critical files are overwritten. The vulnerability affects nx versions from 13.10.0 up to but not including 22.7.10, and from 23.0.0 up to but not including 23.2.1. Most users running nx migrate normally are not exposed because the tool fetches and runs the latest patched nx version. Exposure occurs only if the local vulnerable nx version is forced to run. A fix is available in versions 22.7.10 and 23.2.1. No known exploitation in the wild has been reported.

Nx's self-hosted HTTP remote cache has a Zip-Slip vulnerability (CVE-2026-71476) that allows a malicious or MITM remote cache server to craft tar archives that write files outside the intended cache directory, potentially leading to remote code execution. This affects Nx versions from 21.0.4 up to but not including 23.0.2. The default local cache and Nx Cloud are not affected. The vulnerability is fixed in Nx 23.0.2. Deprecated self-hosted cache packages remain vulnerable and should be migrated off.

The `nx graph` development server had a permissive CORS policy that allowed any website to read responses from the local server, including sensitive project graph data and the output of a `/help` endpoint that executes configured help commands. This could lead to cross-origin information disclosure. Exploitation requires the developer to be running the vulnerable `nx graph` server and to visit a malicious website. Arbitrary command execution is only possible if a malicious help command is already configured in the workspace, which requires prior compromise. The issue affects versions from 17.0.4 up to but not including 22.7.2 and certain beta versions before 23.0.0-beta.2. A fix is available starting with version 22.7.2.