CVE-2026-48027 GHSA-c9j4-9m59-847w
Compromised Nx Console version 18.95.0
- Severity
- 0.0 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 1.85%
- Chance of exploitation in the next 30 days. Higher than 79.12% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since May 27, 2026
- Weakness
- CWE-506 Embedded Malicious Code
- Fix
- None yet
- No fixed version published
Description
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it
- Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
References
Advisories
Issue reports
Write-ups
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-g7cv-rxg3-hmpx Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware | Critical | Same weakness, CWE-506 |
| GHSA-69fq-xp46-6x23 Trivy ecosystem supply chain was briefly compromised | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2025-59374 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-pxx3-g568-hxr4 color-convert@3.1.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
| GHSA-5fvm-p68v-5wmh color-name@2.0.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
| GHSA-4x49-vf9v-38px debug@4.4.2 contains malware after npm account takeover | High | Same weakness, CWE-506 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor