CVE-2026-54753 Details
Description
Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.
A vulnerability exists in Nx versions 17.0.4 prior to 22.7.2 and 23.0.0-beta.0 prior to 23.0.0-beta.2, where the local HTTP server initiated by the 'nx graph' command improperly configured Cross-Origin Resource Sharing (CORS) headers. The server responded with 'Access-Control-Allow-Origin: *', permitting any website to access the server's responses. This flaw could lead to cross-origin information disclosure, exposing sensitive data such as the full project graph and the output of the '/help' endpoint, which executes a target's help command. In rare cases, this vulnerability could allow arbitrary command injection. The issue arises when a developer runs 'nx graph' and visits a malicious website, with the potential for more severe consequences if a targeted project contains a maliciously crafted help command.
Users should upgrade to Nx version 22.7.2 or later. For those on the 21.x line, upgrading to 22.7.2 is recommended, as the 21.x line is not patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nrwl/nx/pull/35494 | [email protected] | Source CodeVendor |
| https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nx | >= 17.0.4, < 22.7.2 (semver) >= 23.0.0-beta.0, < 23.0.0-beta.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |