CVE-2026-104854

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/nrwl/nx/commit/3298fd8b2dd066167eb3cc0410643994a59b0bba
https://github.com/nrwl/nx/commit/63e1abb287a3d69f8ba981828a1de325d0d3dc68
https://github.com/nrwl/nx/commit/71c2253b6aac23b008e192c4e2642c42a5e07545
https://github.com/nrwl/nx/pull/36370
https://github.com/nrwl/nx/releases/tag/22.7.9
https://github.com/nrwl/nx/releases/tag/23.1.2
https://github.com/nrwl/nx/security/advisories/GHSA-w3vv-58gj-gw77

Configurations

No configuration.

History

02 Oct 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-02 17:17

Updated : 2026-10-02 18:17

NVD link : CVE-2026-104854

Mitre link : CVE-2026-104854

CVE.ORG link : CVE-2026-104854

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-104854", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104854", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-02T17:27:34.092813Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nrwl", "product": "nx", "versions": [{"status": "affected", "version": ">= 14.6.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}]}], "published": "2026-10-02T17:17:04.070", "references": [{"url": "https://github.com/nrwl/nx/commit/3298fd8b2dd066167eb3cc0410643994a59b0bba", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/commit/63e1abb287a3d69f8ba981828a1de325d0d3dc68", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/commit/71c2253b6aac23b008e192c4e2642c42a5e07545", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/pull/36370", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/releases/tag/22.7.9", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/releases/tag/23.1.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/security/advisories/GHSA-w3vv-58gj-gw77", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2."}], "lastModified": "2026-10-02T18:17:01.960", "sourceIdentifier": "security-advisories@github.com"}