Nx: Path traversal in nx migrate package-migrations extraction
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nrwl | nx | 13.10.0 to before 22.7.10; 23.0.0 to before 23.2.1 | 22.7.10, 23.2.1 | Patch available | CNA |
| — | nx (npm) | 13.10.0 to before 22.7.10 | 22.7.10 | Patch available | GHSA-hrvq-x7jp-36xv |
| — | nx (npm) | 23.0.0 to before 23.2.1 | 23.2.1 | Patch available | GHSA-hrvq-x7jp-36xv |
- nx Vendornrwl Affected 13.10.0 to before 22.7.10; 23.0.0 to before 23.2.1 Fixed in 22.7.10, 23.2.1 Patch available CNA
- nx (npm) Vendor— Affected 13.10.0 to before 22.7.10 Fixed in 22.7.10 Patch available GHSA-hrvq-x7jp-36xv
- nx (npm) Vendor— Affected 23.0.0 to before 23.2.1 Fixed in 23.2.1 Patch available GHSA-hrvq-x7jp-36xv
Remediation
- Fix · CNA nx (nrwl) Fixed in 22.7.10, 23.2.1
- Fix · GHSA-hrvq-x7jp-36xv nx (npm) Fixed in 22.7.10 Advisory →
- Fix · GHSA-hrvq-x7jp-36xv nx (npm) Fixed in 23.2.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-104853
- 2026-10-05 Affected versions changed · Red Hat
- 2026-10-05 CVSS score added · Red Hat
- 2026-10-06 Alias added: GHSA-hrvq-x7jp-36xv
- 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-hrvq-x7jp-36xv
- 2026-10-06 CVSS score added · GHSA-hrvq-x7jp-36xv
- 2026-10-06 Weakness changed · GHSA-hrvq-x7jp-36xv
- 2026-10-06 9 new references · GHSA-hrvq-x7jp-36xv
References
Other 8
- https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv
- https://github.com/nrwl/nx/pull/36887
- https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f
- https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90
- https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f
- https://github.com/nrwl/nx/releases/tag/22.7.10
- https://github.com/nrwl/nx/releases/tag/23.2.1
- https://github.com/nrwl/nx
More nrwl vulnerabilities
- TI-2026-50091 Nx: Zip-Slip in the self-hosted remote cache CVSS 4.0HIGH 8.7
- TI-2026-66138 Nx daemon and plugin worker sockets are accessible to other local users CVSS 4.0HIGH 8.5
- TI-2026-82771 OS command injection in Nx @nx/maven and @nx/gradle via nx.json CVSS 4.0HIGH 7.3
- TI-2026-66140 Nx: OS command injection in the @nx/docker release pipeline CVSS 4.0HIGH 7.3
- TI-2026-39559 Nx: `nx graph` dev server permissive CORS policy CVSS 3.1MEDIUM 5.9
Sources
- CVE-2026-104853 · CVE Program
- CVE-2026-104853 · NVD
- FIRST EPSS
- GHSA-hrvq-x7jp-36xv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-104853 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences