CVE-2026-104853

Name of the Vulnerable Software and Affected Versions Nx versions 13.10.0 through 22.7.9 Nx versions 23.0.0 through 23.2.0

Description Nx migration planning fails to validate that the nx-migrations.migrations value read from a target package manifest is a contained relative path. A hostile direct dependency or a package introduced via a trusted package's packageGroup can provide absolute paths or .. segments. This allows the nx migrate process to write attacker-controlled bytes outside the intended temporary directory or truncate existing writable files. This issue occurs during migration planning before the migration list is reviewed or the --run-migrations flag is used. The vulnerability is triggered when the standard nx@latest handoff is bypassed using NX USE LOCAL, NX MIGRATE USE LOCAL, NX MIGRATE CLI VERSION, --run-id, or following a temporary-install failure.

Recommendations Update Nx to version 22.7.10 or later. Update Nx to version 23.2.1 or later.