Nx daemon and plugin worker sockets are created in a shared temporary directory with default permissions, allowing any local user on the same machine to connect to them. This can lead to code execution inside the daemon process by sending a specially crafted request. The vulnerability affects multi-user environments such as shared build servers or containers with multiple user accounts. Single-user machines are not affected. Versions from 14.6.0 up to but not including 22.7.9, and from 23.0.0 up to but not including 23.1.2 are vulnerable. Upgrading to 22.7.9 or 23.1.2 or later mitigates the issue.