nrwl güvenlik açıkları (CVE)

nrwl için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

7 sonuç
7.3Yüksek
CVE-2026-104859

Nx: OS command injection in the @nx/docker release pipeline

nrwl nx

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.r…

8.7Yüksek
CVE-2026-71476

Nx: Zip-Slip in the self-hosted remote cache

nrwl nx

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) …

5.9Orta
CVE-2026-54753

Nx: `nx graph` dev server permissive CORS policy

nrwl nx

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the serv…

1.4%EPSS
9.3Kritik
CVE-2026-48027 KEV Fidye yazılımında kullanılıyor

Compromised Nx Console version 18.95.0

nrwl nx-console

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, …

1.8%EPSS