Read the docs
TI-2026-66138 Aliases CVE-2026-104854GHSA-w3vv-58gj-gw77

Nx daemon and plugin worker sockets are accessible to other local users

Priority LOW 38CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Fixed nx (nrwl): 22.7.9, 23.1.2nx (npm): 22.7.9, 23.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nrwlnx14.6.0 to before 22.7.9; 23.0.0 to before 23.1.222.7.9, 23.1.2Patch availableCNA
—nx (npm)14.6.0 to before 22.7.922.7.9Patch availableGHSA-w3vv-58gj-gw77
—nx (npm)23.0.0 to before 23.1.223.1.2Patch availableGHSA-w3vv-58gj-gw77
  • nx Vendornrwl Affected 14.6.0 to before 22.7.9; 23.0.0 to before 23.1.2 Fixed in 22.7.9, 23.1.2 Patch available CNA
  • nx (npm) Vendor— Affected 14.6.0 to before 22.7.9 Fixed in 22.7.9 Patch available GHSA-w3vv-58gj-gw77
  • nx (npm) Vendor— Affected 23.0.0 to before 23.1.2 Fixed in 23.1.2 Patch available GHSA-w3vv-58gj-gw77

Remediation

  • Fix · CNA nx (nrwl) Fixed in 22.7.9, 23.1.2
  • Fix · GHSA-w3vv-58gj-gw77 nx (npm) Fixed in 22.7.9 Advisory →
  • Fix · GHSA-w3vv-58gj-gw77 nx (npm) Fixed in 23.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-104854
  2. 2026-10-05 Affected versions changed · Red Hat
  3. 2026-10-05 CVSS score added · Red Hat
  4. 2026-10-06 Alias added: GHSA-w3vv-58gj-gw77
  5. 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-w3vv-58gj-gw77
  6. 2026-10-06 CVSS score added · GHSA-w3vv-58gj-gw77
  7. 2026-10-06 Weakness changed · GHSA-w3vv-58gj-gw77
  8. 2026-10-06 9 new references · GHSA-w3vv-58gj-gw77

References

Advisory 1

Other 8

  • TI-2026-50091 Nx: Zip-Slip in the self-hosted remote cache CVSS 4.0HIGH 8.7
  • TI-2026-82771 OS command injection in Nx @nx/maven and @nx/gradle via nx.json CVSS 4.0HIGH 7.3
  • TI-2026-66140 Nx: OS command injection in the @nx/docker release pipeline CVSS 4.0HIGH 7.3
  • TI-2026-39559 Nx: `nx graph` dev server permissive CORS policy CVSS 3.1MEDIUM 5.9
  • TI-2026-66137 Nx: Path traversal in nx migrate package-migrations extraction CVSS 4.0MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences