CVE-2026-104854

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.

• CWE-269
• CWE-732

• https://github.com/nrwl/nx/commit/3298fd8b2dd066167eb3cc0410643994a59b0bba
• https://github.com/nrwl/nx/commit/63e1abb287a3d69f8ba981828a1de325d0d3dc68
• https://github.com/nrwl/nx/commit/71c2253b6aac23b008e192c4e2642c42a5e07545
• https://github.com/nrwl/nx/pull/36370
• https://github.com/nrwl/nx/releases/tag/22.7.9
• https://github.com/nrwl/nx/releases/tag/23.1.2
• https://github.com/nrwl/nx/security/advisories/GHSA-w3vv-58gj-gw77

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104846Seroval facilitates JS value stringification, including comp…9.8
• CVE-2026-104847ProseMirror's view component renders and manages the editabl…8.5
• CVE-2026-104848Tinypool is a minimal Node.js worker thread pool implementat…9.5
• CVE-2026-104849Tinypool is a minimal Node.js worker thread pool implementat…9.5
• CVE-2026-104851fsspec is a specification and Python implementation framewor…8.8
• CVE-2026-104853Nx is a monorepo solution for TypeScript and polyglot codeba…5.8
• CVE-2026-104855Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.…2
• CVE-2026-104859Nx is a monorepo solution for TypeScript and polyglot codeba…7.3
• CVE-2026-104861probe-image-size gets image dimensions without downloading t…7.5
• CVE-2026-1049A security vulnerability has been detected in LigeroSmart up…5.4
• CVE-2026-104900MISP contains a stored cross-site scripting (XSS) vulnerabil…5.3
• CVE-2026-104901MISP contains a cross-site scripting (XSS) vulnerability in …5.1