Skip to content

Vendor

nx vulnerabilities

8 published CVES affecting nx, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
8
Critical
2
High
4
Medium
2
Low
0
Unscored
0
CISA KEV
1
Atom feed of nx alerts

Products

Latest nx CVEs

Newest publication first

  2. CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

    Published
    HighCVSS 7.3 EPSS 0.15%

    Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and reg...

  3. CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

    Published
    HighCVSS 8.7 EPSS 0.87%

    Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) remote cache server c...

  4. CVE-2026-48027 Compromised Nx Console version 18.95.0

    Published
    CriticalCVSS 9.3 EPSS 1.8% CISA KEV added 2026-05-27 Ransomware Exploited in the wild

    Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detec...

  5. CVE-2025-36852 Build Cache Poisoning via Untrusted Pull Requests

    Published
    CriticalCVSS 9.4 EPSS 0.26%

    A critical security vulnerability exists in remote cache extensions for common build systems utilizing bucket-based remote cache (such as those using Amazon S3, Google Cloud Storage, or similar object storage) that allows any contributor with pull request privileges to inject com...

  6. CVE-2007-2199 PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joom...

    Published
    MediumCVSS 6.8 EPSS 46.9%

    PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConcept Library, as used in multiple products including (1) Joomla! 1.5.0 Beta, (2) N/X Web Content Management System (WCMS) 4.5, (3) CJG EXPLOR...

  7. CVE-2006-5625 PHP remote file inclusion vulnerability in wwwdev/nxheader.inc.php in N/X 2002 Professional Edition Web Content Management System (WCMS) 4.1 and earlier allows remote attackers to execute arbitrary PH...

    Published
    MediumCVSS 5.1 EPSS 2.4%

    PHP remote file inclusion vulnerability in wwwdev/nxheader.inc.php in N/X 2002 Professional Edition Web Content Management System (WCMS) 4.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the c[path] parameter.

  8. CVE-2003-1251 The (1) menu.inc.php, (2) datasets.php and (3) mass_operations.inc.php (mistakenly referred to as mass_opeations.inc.php) scripts in N/X 2002 allow remote attackers to execute arbitrary PHP code via a...

    Published
    HighCVSS 7.5 EPSS 7.6%

    The (1) menu.inc.php, (2) datasets.php and (3) mass_operations.inc.php (mistakenly referred to as mass_opeations.inc.php) scripts in N/X 2002 allow remote attackers to execute arbitrary PHP code via a c_path that references a URL on a remote web server that contains the code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.