Log in Start free

Vulnerability · Published Oct 2, 2026 · Assigned by GitHub_M

CVE-2026-104854Nx daemon and plugin worker sockets are accessible to other local users

High 8.5

In plain English

A high-severity privilege mismanagement in nx from nrwl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.1%top 96.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. Another unprivileged local account on a shared build server, developer host, or multi-user container can discover and connect to a running socket because the transport performs no authentication and relies on filesystem containment. The daemon's PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that controls a file to execute code as the account running Nx; other handlers can expose workspace file contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable plugin-worker sockets, while single-user machines without another local account are not exposed. This issue is fixed in versions 22.7.9 and 23.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnx22.7.9GHSA-w3vv-58gj-gw77
npmnx23.1.2GHSA-w3vv-58gj-gw77

Affected products (as reported)

VendorProductVersions
nrwl nx >= 14.6.0, < 22.7.9>= 23.0.0, < 23.1.2

Weakness: CWE-269, CWE-732 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References