CVE-2026-104854

Name of the Vulnerable Software and Affected Versions Nx versions prior to 22.7.9 Nx versions 23.0.0 through 23.1.1

Description Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build servers, developer hosts, or multi-user containers, an unprivileged local account can discover and connect to these sockets because the transport lacks authentication and relies solely on filesystem containment. A caller can send a PROCESS IN BACKGROUND request containing a module path to invoke its default export, enabling remote code execution as the account running Nx. Additionally, other handlers may expose task hashes, project graphs, and workspace file contents.

Recommendations Update Nx to version 22.7.9. Update Nx to version 23.1.2.