CVE-2026-54753

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/nrwl/nx/pull/35494
https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Nx es una solución de monorepo para bases de código TypeScript y políglotas. Desde 17.0.4 hasta 22.7.2 y 23.0.0-beta.2, el servidor HTTP local iniciado por nx graph envió Access-Control-Allow-Origin: * en cada respuesta, permitiendo que cualquier sitio web que un desarrollador visitara leyera las respuestas del servidor de origen cruzado - incluyendo el grafo completo del proyecto y la salida del endpoint /help, que ejecuta el comando de ayuda configurado de un objetivo. El impacto práctico es típicamente revelación de información de origen cruzado, pero puede ser inyección de comandos arbitraria en casos raros. Esta vulnerabilidad está corregida en 22.7.2 y 23.0.0-beta.2.

Information

Published : 2026-06-26 19:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-54753

Mitre link : CVE-2026-54753

CVE.ORG link : CVE-2026-54753

JSON object : View

Products Affected

No product.

CWE

CWE-749

Exposed Dangerous Method or Function

CWE-942

Permissive Cross-domain Security Policy with Untrusted Domains

{"id": "CVE-2026-54753", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54753", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T19:09:19.972525Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nrwl", "product": "nx", "versions": [{"status": "affected", "version": ">= 17.0.4, < 22.7.2"}, {"status": "affected", "version": ">= 23.0.0-beta.0, < 23.0.0-beta.2"}]}]}], "published": "2026-06-26T19:16:43.937", "references": [{"url": "https://github.com/nrwl/nx/pull/35494", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-749"}, {"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."}, {"lang": "es", "value": "Nx es una soluci\u00f3n de monorepo para bases de c\u00f3digo TypeScript y pol\u00edglotas. Desde 17.0.4 hasta 22.7.2 y 23.0.0-beta.2, el servidor HTTP local iniciado por nx graph envi\u00f3 Access-Control-Allow-Origin: * en cada respuesta, permitiendo que cualquier sitio web que un desarrollador visitara leyera las respuestas del servidor de origen cruzado - incluyendo el grafo completo del proyecto y la salida del endpoint /help, que ejecuta el comando de ayuda configurado de un objetivo. El impacto pr\u00e1ctico es t\u00edpicamente revelaci\u00f3n de informaci\u00f3n de origen cruzado, pero puede ser inyecci\u00f3n de comandos arbitraria en casos raros. Esta vulnerabilidad est\u00e1 corregida en 22.7.2 y 23.0.0-beta.2."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}