CVE-2026-104854
Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: GitHub, Inc.

Description
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-19
AI Q&A
2026-10-02
EPSS Evaluated
2026-10-18
NVD
CVE-2026-104854
EUVD
EUVD-2026-91762

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nrwl nx >= 14.6.0, < 22.7.9
nrwl nx >= 23.0.0, < 23.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104854 affects Nx versions between 14.6.0 and 22.7.8, and 23.0.0 to 23.1.1. It involves Unix domain sockets for the Nx daemon and plugin workers being created in shared temporary directories with default permissions. This allows other local users on multi-user systems to connect to these sockets, execute arbitrary code as the Nx user, and access sensitive data like workspace files or project graphs. The sockets lack authentication and rely solely on filesystem containment.

Detection Guidance

Check for Nx daemon or plugin worker sockets in system temp directories like /tmp or /var/tmp. Look for files named nx-daemon.sock or similar in /tmp/.nx/<uid>/sockets or ~/.nx/sockets. Verify socket permissions with 'ls -la /tmp/.nx/<uid>/sockets' or 'find /tmp -name '*nx*' -type s'. If sockets exist with permissions allowing group/other access, the system may be vulnerable.

Impact Analysis

If you use Nx on a shared build server, developer host, or multi-user container, another local user could exploit this to run malicious code as your user account, steal sensitive data, or disrupt builds. Single-user machines without additional local accounts are not affected. Disabling the daemon does not fully mitigate the issue as plugin-worker sockets remain vulnerable.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive data or allowing unauthorized code execution on shared systems. If exploited, it may lead to unauthorized access to workspace files, project graphs, or task hashes, violating confidentiality requirements. Multi-user environments like CI runners or build servers are particularly at risk, as the flaw allows local users to escalate privileges or access restricted resources.

Mitigation Strategies

Upgrade Nx to version 22.7.9 or 23.1.2 or later. Run 'nx reset' to remove vulnerable sockets. Set NX_SOCKET_DIR to a restricted directory and disable the daemon as a temporary workaround. Ensure no shared users exist on the system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart