CVE-2026-48027

May 27, 2026, 8:34 p.m.

9.3
Critical

Description

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

Product(s) Impacted

Vendor Product Versions
Nx
  • Nx Console
  • 18.95.0

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-506
Embedded Malicious Code
The product contains code that appears to be malicious in nature.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a nx nx_console 18.95.0 / / / / visual_studio_code / /

References

https://github.com/nrwl/nx-console/issues/3139
https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w
https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise
https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027

Tags

[email protected]
CWE-506
2026-05-27
CVE-2026-48027

CVSS Score

9.3 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: May 27, 2026, 5:16 p.m.
Last Modified: May 27, 2026, 8:34 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.