The `nx graph` development server had a permissive CORS policy that allowed any website to read responses from the local server, including sensitive project graph data and the output of a `/help` endpoint that executes configured help commands. This could lead to cross-origin information disclosure. Exploitation requires the developer to be running the vulnerable `nx graph` server and to visit a malicious website. Arbitrary command execution is only possible if a malicious help command is already configured in the workspace, which requires prior compromise. The issue affects versions from 17.0.4 up to but not including 22.7.2 and certain beta versions before 23.0.0-beta.2. A fix is available starting with version 22.7.2.