Threats tagged 'ghsa-vp3h-ghgh-jr7g'

Nx versions from 20.8.0 up to but not including 22.7.7 and 23.0.2 have a path traversal vulnerability in the self-hosted HTTP remote cache feature. This flaw allows a malicious or man-in-the-middle remote cache server to craft tar archives that write files outside the intended cache directory, potentially leading to remote code execution. The default local cache and Nx Cloud are not affected. The issue is fixed in versions 22.7.7 and 23.0.2.