Vulnerability-Lookup

CVE-2026-54753 (GCVE-0-2026-54753)

Vulnerability from cvelistv5 – Published: 2026-06-26 18:13 – Updated: 2026-06-26 19:09

Title

Nx: `nx graph` dev server permissive CORS policy

Summary

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 19:09 UTC

CWE

CWE-749 - Exposed Dangerous Method or Function
CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/nrwl/nx/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/nrwl/nx/pull/35494	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
nrwl	nx	Affected: >= 17.0.4, < 22.7.2 Affected: >= 23.0.0-beta.0, < 23.0.0-beta.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54753",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T19:09:19.972525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T19:09:33.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nx",
          "vendor": "nrwl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 17.0.4, \u003c 22.7.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target\u0027s configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T18:13:34.371Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
        },
        {
          "name": "https://github.com/nrwl/nx/pull/35494",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nrwl/nx/pull/35494"
        }
      ],
      "source": {
        "advisory": "GHSA-g2r8-wvmj-jf5w",
        "discovery": "UNKNOWN"
      },
      "title": "Nx: `nx graph` dev server permissive CORS policy"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54753",
    "datePublished": "2026-06-26T18:13:34.371Z",
    "dateReserved": "2026-06-15T23:12:41.965Z",
    "dateUpdated": "2026-06-26T19:09:33.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54753",
      "date": "2026-09-20",
      "epss": "0.01204",
      "percentile": "0.66887"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "nx",
                "vendor": "nrwl",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 17.0.4, \u003c 22.7.2"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target\u0027s configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."
          }
        ],
        "id": "CVE-2026-54753",
        "lastModified": "2026-06-26T20:20:22.420",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54753",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T19:09:19.972525Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-26T19:16:43.937",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nrwl/nx/pull/35494"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-749"
              },
              {
                "lang": "en",
                "value": "CWE-942"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-09T09:22:21+00:00",
      "cve": "CVE-2026-54753",
      "id": "CVE-2026-54753",
      "initial_release_date": "2026-06-26T18:13:34.371000+00:00",
      "product_status:known_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Nx: Nx: `nx graph` dev server permissive CORS policy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54753.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54753",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-26T19:09:19.972525Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-26T19:09:25.959Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "nx",
              "vendor": "nrwl",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 17.0.4, \u003c 22.7.2"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target\u0027s configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-749",
                  "description": "CWE-749: Exposed Dangerous Method or Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-942",
                  "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-26T18:13:34.371Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
            },
            {
              "name": "https://github.com/nrwl/nx/pull/35494",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nrwl/nx/pull/35494"
            }
          ],
          "source": {
            "advisory": "GHSA-g2r8-wvmj-jf5w",
            "discovery": "UNKNOWN"
          },
          "title": "Nx: `nx graph` dev server permissive CORS policy"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54753",
        "datePublished": "2026-06-26T18:13:34.371Z",
        "dateReserved": "2026-06-15T23:12:41.965Z",
        "dateUpdated": "2026-06-26T19:09:33.257Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BREW-NX-CVE-2026-54753 (GHSA-G2R8-WVMJ-JF5W)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:19 – Updated: 2026-09-17 18:53 – Source website

Summary

`nx graph` dev server permissive CORS policy

Details

Summary

The local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases.

Severity

Exploitation requires the developer to be running nx graph and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).

Affected & Patched Versions

Package: nx (npm).

Affected: >= 17.0.4, < 22.7.2 and >= 23.0.0-beta.0, < 23.0.0-beta.2
Patched: 22.7.2+ (backport) and 23.0.0 (first in 23.0.0-beta.2)

The wildcard CORS header was introduced in 17.0.4; the /help execution endpoint in 19.4.0. The 21.x line is not patched — 21.x users should upgrade to 22.7.2 or later.

Details

nx graph starts a local server (default http://127.0.0.1:4211). Before the fix, its request handler set a wildcard CORS header on every response:

res.setHeader('Access-Control-Allow-Origin', '*');

The /help endpoint runs a target's configured command:

const command = target.metadata?.help?.command;
return execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();

A GET /help is a CORS "simple request", so a malicious page could fetch() it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.

The command is not attacker-controlled through the request — it comes from the workspace's project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For /help to run anything malicious, a target carrying a malicious help.command must already exist in the project graph, which can only be introduced by installing a malicious package or by altering the workspace's own code/configuration — both of which already grant code execution independent of this flaw.

The fix (#35494) removes the header; the browser's same-origin policy then blocks cross-origin reads.

References

Fix: nrwl/nx#35494
Introduced: nrwl/nx#20744 (CORS), nrwl/nx#26629 (/help)

Credits

Thanks to Nozomu Sasaki (Paul) (@morimori-dev) for finding and responsibly reporting this issue.

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

URL

Type

	https://github.com/nrwl/nx/security/advisories/GH…	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54753	ADVISORY
	https://github.com/nrwl/nx/pull/35494	WEB
	https://github.com/nrwl/nx/commit/7620c1ffe598086…	WEB
	https://github.com/nrwl/nx/commit/e59122c5569cf20…	WEB
	https://github.com/nrwl/nx	PACKAGE
	https://github.com/nrwl/nx/releases/tag/22.7.2	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "23.0.0-beta.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "nx",
        "purl": "pkg:brew/nx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "21.0.4"
            },
            {
              "fixed": "22.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/nx@23.2.1",
        "name": "nx",
        "strategy": "registry",
        "subject_version": "23.2.1"
      }
    ]
  },
  "details": "## Summary\n\nThe local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the `/help` endpoint, which runs a target\u0027s configured help command. The practical impact is typically **cross-origin information disclosure**, but can be arbitrary command injection in rare cases.\n\n## Severity\n\n\nExploitation requires the developer to be running `nx graph` and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).\n\n## Affected \u0026 Patched Versions\n\nPackage: `nx` (npm).\n\n- **Affected:** `\u003e= 17.0.4, \u003c 22.7.2` and `\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2`\n- **Patched:** `22.7.2`+ (backport) and `23.0.0` (first in `23.0.0-beta.2`)\n\nThe wildcard CORS header was introduced in `17.0.4`; the `/help` execution endpoint in `19.4.0`. **The `21.x` line is not patched** \u2014 `21.x` users should upgrade to `22.7.2` or later.\n\n## Details\n\n`nx graph` starts a local server (default `http://127.0.0.1:4211`). Before the fix, its request handler set a wildcard CORS header on every response:\n\n```ts\nres.setHeader(\u0027Access-Control-Allow-Origin\u0027, \u0027*\u0027);\n```\n\nThe `/help` endpoint runs a target\u0027s configured command:\n\n```ts\nconst command = target.metadata?.help?.command;\nreturn execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();\n```\n\nA `GET /help` is a CORS \"simple request\", so a malicious page could `fetch()` it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.\n\nThe command is not attacker-controlled through the request \u2014 it comes from the workspace\u0027s project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For `/help` to run anything malicious, a target carrying a malicious `help.command` must already exist in the project graph, which can only be introduced by **installing a malicious package** or by **altering the workspace\u0027s own code/configuration** \u2014 both of which already grant code execution independent of this flaw.\n\nThe fix ([#35494](https://github.com/nrwl/nx/pull/35494)) removes the header; the browser\u0027s same-origin policy then blocks cross-origin reads.\n\n## References\n\n- Fix: [nrwl/nx#35494](https://github.com/nrwl/nx/pull/35494)\n- Introduced: [nrwl/nx#20744](https://github.com/nrwl/nx/pull/20744) (CORS), [nrwl/nx#26629](https://github.com/nrwl/nx/pull/26629) (`/help`)\n\n## Credits\n\nThanks to Nozomu Sasaki (Paul) ([@morimori-dev](https://github.com/morimori-dev)) for finding and responsibly reporting this issue.",
  "id": "BREW-nx-CVE-2026-54753",
  "modified": "2026-09-17T18:53:55Z",
  "published": "2026-08-13T17:19:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54753"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/pull/35494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/commit/7620c1ffe598086ce5e66457c7e6e38799bb499d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/commit/e59122c5569cf201561b9995ce4e34a304f4fb03"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nrwl/nx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/releases/tag/22.7.2"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`nx graph` dev server permissive CORS policy",
  "upstream": [
    "GHSA-g2r8-wvmj-jf5w",
    "CVE-2026-54753"
  ]
}

FKIE_CVE-2026-54753

Vulnerability from fkie_nvd - Published: 2026-06-26 19:16 - Updated: 2026-06-26 20:20

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/nrwl/nx/pull/35494
	security-advisories@github.com	https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nx",
          "vendor": "nrwl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 17.0.4, \u003c 22.7.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target\u0027s configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."
    }
  ],
  "id": "CVE-2026-54753",
  "lastModified": "2026-06-26T20:20:22.420",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54753",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-26T19:09:19.972525Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-26T19:16:43.937",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nrwl/nx/pull/35494"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-749"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-G2R8-WVMJ-JF5W

Vulnerability from github – Published: 2026-07-31 16:50 – Updated: 2026-07-31 16:50

Summary

`nx graph` dev server permissive CORS policy

Details

Summary

Severity

Affected & Patched Versions

Package: nx (npm).

Affected: >= 17.0.4, < 22.7.2 and >= 23.0.0-beta.0, < 23.0.0-beta.2
Patched: 22.7.2+ (backport) and 23.0.0 (first in 23.0.0-beta.2)

The wildcard CORS header was introduced in 17.0.4; the /help execution endpoint in 19.4.0. The 21.x line is not patched — 21.x users should upgrade to 22.7.2 or later.

Details

nx graph starts a local server (default http://127.0.0.1:4211). Before the fix, its request handler set a wildcard CORS header on every response:

res.setHeader('Access-Control-Allow-Origin', '*');

The /help endpoint runs a target's configured command:

const command = target.metadata?.help?.command;
return execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();

The fix (#35494) removes the header; the browser's same-origin policy then blocks cross-origin reads.

References

Fix: nrwl/nx#35494
Introduced: nrwl/nx#20744 (CORS), nrwl/nx#26629 (/help)

Credits

Thanks to Nozomu Sasaki (Paul) (@morimori-dev) for finding and responsibly reporting this issue.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.4"
            },
            {
              "fixed": "22.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "nx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0.0-beta.0"
            },
            {
              "fixed": "23.0.0-beta.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54753"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749",
      "CWE-942"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T16:50:24Z",
    "nvd_published_at": "2026-06-26T19:16:43Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting any website a developer visited read the server\u0027s responses cross-origin \u2014 including the full project graph and the output of the `/help` endpoint, which runs a target\u0027s configured help command. The practical impact is typically **cross-origin information disclosure**, but can be arbitrary command injection in rare cases.\n\n## Severity\n\n\nExploitation requires the developer to be running `nx graph` and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).\n\n## Affected \u0026 Patched Versions\n\nPackage: `nx` (npm).\n\n- **Affected:** `\u003e= 17.0.4, \u003c 22.7.2` and `\u003e= 23.0.0-beta.0, \u003c 23.0.0-beta.2`\n- **Patched:** `22.7.2`+ (backport) and `23.0.0` (first in `23.0.0-beta.2`)\n\nThe wildcard CORS header was introduced in `17.0.4`; the `/help` execution endpoint in `19.4.0`. **The `21.x` line is not patched** \u2014 `21.x` users should upgrade to `22.7.2` or later.\n\n## Details\n\n`nx graph` starts a local server (default `http://127.0.0.1:4211`). Before the fix, its request handler set a wildcard CORS header on every response:\n\n```ts\nres.setHeader(\u0027Access-Control-Allow-Origin\u0027, \u0027*\u0027);\n```\n\nThe `/help` endpoint runs a target\u0027s configured command:\n\n```ts\nconst command = target.metadata?.help?.command;\nreturn execSync(command, { cwd: target.options?.cwd ?? workspaceRoot }).toString();\n```\n\nA `GET /help` is a CORS \"simple request\", so a malicious page could `fetch()` it with no preflight, and the wildcard header let the page read the result. This exposes the project graph (project names, file paths, dependencies, build configuration) and the output of any configured help command.\n\nThe command is not attacker-controlled through the request \u2014 it comes from the workspace\u0027s project configuration, and first-party plugins (jest, vite, cypress) populate it with benign, read-only help commands. For `/help` to run anything malicious, a target carrying a malicious `help.command` must already exist in the project graph, which can only be introduced by **installing a malicious package** or by **altering the workspace\u0027s own code/configuration** \u2014 both of which already grant code execution independent of this flaw.\n\nThe fix ([#35494](https://github.com/nrwl/nx/pull/35494)) removes the header; the browser\u0027s same-origin policy then blocks cross-origin reads.\n\n## References\n\n- Fix: [nrwl/nx#35494](https://github.com/nrwl/nx/pull/35494)\n- Introduced: [nrwl/nx#20744](https://github.com/nrwl/nx/pull/20744) (CORS), [nrwl/nx#26629](https://github.com/nrwl/nx/pull/26629) (`/help`)\n\n## Credits\n\nThanks to Nozomu Sasaki (Paul) ([@morimori-dev](https://github.com/morimori-dev)) for finding and responsibly reporting this issue.",
  "id": "GHSA-g2r8-wvmj-jf5w",
  "modified": "2026-07-31T16:50:24Z",
  "published": "2026-07-31T16:50:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54753"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/pull/35494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/commit/7620c1ffe598086ce5e66457c7e6e38799bb499d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/commit/e59122c5569cf201561b9995ce4e34a304f4fb03"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nrwl/nx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nrwl/nx/releases/tag/22.7.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`nx graph` dev server permissive CORS policy"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54753 (GCVE-0-2026-54753)

BREW-NX-CVE-2026-54753 (GHSA-G2R8-WVMJ-JF5W)

Summary

Severity

Affected & Patched Versions

Details

References

Credits

FKIE_CVE-2026-54753

GHSA-G2R8-WVMJ-JF5W

Summary

Severity

Affected & Patched Versions

Details

References

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour