[ Vendor · 4 CVEs ]
nrwl
CVEs affecting nrwl published in the last 30 days, plus any nrwl CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104859 | 2 Oct 2026 | CVSS 7.3 | @nx/docker: OS command injection in the @nx/docker release pipelineNx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release… | Fix |
| CVE-2026-104854 | 2 Oct 2026 | CVSS 8.5 | Nx daemon and plugin worker sockets are accessible to other local usersNx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon… | Fix |
| CVE-2026-104853 | 2 Oct 2026 | CVSS 5.8 | Nx: Path traversal in nx migrate package-migrations extractionNx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the… | Fix |
| CVE-2026-48027 | 27 May 2026 | CVSS 9.8 | Nx Console Embedded Malicious CodeNx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and… | Exploited |