CVE-2026-104853 is a path traversal vulnerability in the nx tool's migrate command. It occurs because the migration file path from a package manifest is not validated, allowing extraction outside the intended temporary directory. This can lead to attacker-controlled file writes or truncation of files writable by the user, potentially enabling code execution if critical files are overwritten. The vulnerability affects nx versions from 13.10.0 up to but not including 22.7.10, and from 23.0.0 up to but not including 23.2.1. Most users running nx migrate normally are not exposed because the tool fetches and runs the latest patched nx version. Exposure occurs only if the local vulnerable nx version is forced to run. A fix is available in versions 22.7.10 and 23.2.1. No known exploitation in the wild has been reported.