CVE-2026-48027 PUBLISHED

Compromised Nx Console version 18.95.0

Assigner: GitHub_M
Reserved: 20.05.2026 Published: 27.05.2026 Updated: 28.05.2026

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor nrwl
Product nx-console
Versions
  • Version = 18.95.0 is affected

References

Problem Types

  • CWE-506: Embedded Malicious Code CWE