CVE-2026-71476

Received Received - Intake

Path Traversal in Nx Self-Hosted Remote Cache

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx, which can be escalated to remote code execution. Nx's default local cache and Nx Cloud are not affected; only workspaces configured to use a self-hosted remote cache are affected. This issue is fixed in versions 22.7.7 and 23.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71476

Affected Vendors & Products

Vendor	Product	Version / Range
nrwl	nx	20.8.0
nrwl	nx	to 22.7.7 (inc)
nrwl	nx	23.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Nx monorepo tool for TypeScript and polyglot codebases. Between versions 20.8.0 and 22.7.7, and 23.0.2, the self-hosted HTTP remote cache does not restrict where files are written when extracting downloaded cache artifacts. A malicious or compromised remote cache server could send a specially crafted tar archive that writes files outside the intended cache directory, potentially leading to remote code execution.

Detection Guidance

To detect this vulnerability, check if your Nx workspace is configured to use a self-hosted remote cache and verify the version of Nx. Run 'nx report' to check the installed version. If it is between 20.8.0 and 22.7.6 or 23.0.0 and 23.0.1, the system is vulnerable.

Impact Analysis

If you use a self-hosted remote cache with Nx in the affected versions, an attacker could exploit this to write malicious files anywhere on your system. This could allow them to execute arbitrary code, steal data, or take control of your machine. Only workspaces using self-hosted remote caches are affected; default local cache and Nx Cloud are not vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements like GDPR or HIPAA. If exploited, it could result in unauthorized data exposure, access, or modification, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade Nx to version 22.7.7 or 23.0.2 or later to fix the vulnerability. If using a self-hosted remote cache, ensure it is not compromised and verify the integrity of cache artifacts.

Hi! I’m here to help you understand CVE-2026-71476. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70