CVE-2026-54753

Name of the Vulnerable Software and Affected Versions Nx versions 17.0.4 through 22.7.1 Nx versions 23.0.0-beta.0 through 23.0.0-beta.1

Description The local HTTP server used by the nx graph command implements a permissive Cross-Origin Resource Sharing (CORS) policy by sending the Access-Control-Allow-Origin: * header on all responses. This allows any external website visited by a developer to read the server's responses cross-origin, potentially exposing the full project graph and the output of the /help endpoint. Because the /help endpoint executes a target's configured help command, this issue can lead to cross-origin information disclosure or, in rare instances, arbitrary command injection.

Recommendations Update to version 22.7.2. Update to version 23.0.0-beta.2.