@0xdeepak/wallets (0.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1161 more potentially affected by CVE-2026-104854 via nx (>=14.6.0, <=22.7.8)

nx NPM version =14.6.0, =1.2.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.2.1, =0.0.1, =0.0.1, =0.1.5, =0.1.8 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.87), @brabander/config-eslint (>=0.1.1, <=0.5.1) +175 more potentially affected by CVE-2026-104854 via nx (>=23.0.0, <=23.1.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.1 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

NPM: Nx daemon and plugin worker sockets are accessible to other local users

NPM: Nx daemon and plugin worker sockets are accessible to other local users vulnerability discovered by ? in WordPress Npm nx versions = 14.6.0, 22.7.9...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0), @brabander/config-eslint (>=0.1.1, <=0.5.1) +177 more potentially affected by CVE-2026-104853 via nx (>=23.0.0, <=23.2.0-rc.2)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.4.0, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.2.0 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

@0xdeepak/wallets (0.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1191 more potentially affected by CVE-2026-104853 via nx (>=13.10.0, <=22.7.9)

nx NPM version =13.10.0, =1.2.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.2.1, =0.0.1, =0.0.1, =0.1.5, =0.1.8 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

EUVD-2026-91761

Nx: Path traversal in nx migrate package-migrations extraction...

NPM: Nx: Path traversal in nx migrate package-migrations extraction

NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...

GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

CVE-2013-2028-x64-bypass-ssp-and-pie-PoC

NX PIE SSP ASLRをバイパスするための このPoCは安定していません。 httpサービスがダウンすることがあります。 morecore-offsetを修正し、正しいlibc-fileを選択する必要があります。...

CVE-2026-104853

A flaw was found in Nx. During migration planning, the application reads migration file paths from package manifests without validating that they remain within the intended directory. An attacker supplying a malicious package dependency can exploit this path traversal issue using directory...

CVE-2026-104854

A flaw was found in Nx. The application creates communication endpoints Unix domain sockets for its background service and worker processes in shared temporary directories without proper access permissions or authentication. A local attacker sharing the same system can connect to these endpoints ...

CTFs

CTF 攻略記事 やあ、私は Sean です。余暇に CTF の問題を解くのが好きです。現在の仕事では バイナリエクスプロイトとソフトウェアリバースエンジニアリングを多く扱っているため、 どちらかといえばそれらのカテゴリに焦点を当てがちです。ネットで見かける攻略記事の多くは ひどいものなので、ここにある記事が基礎的な概念のいくつかをよりうまく説明できていると 願っています。 すべての解法には、pwntools で書かれた再現可能なソリューションを可能な限り含めるように しています。大切なのはフラグではなく、フラグにたどり着くまでの道のりです。...

[SECURITY] Fedora 45 Update: nx-libs-3.5.99.27-11.fc45

NX is a software suite which implements very efficient compression of the X11 protocol. This increases performance when using X applications over a network, especially a slow one...

Command Injection

Overview @nx/docker is a The Nx Plugin for Docker to aid in containerizing projects. Affected versions of this package are vulnerable to Command Injection via the docker tag, docker push, and docker images calls in the release pipeline, where registry URL, repository name, version scheme,...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...

Access Control Bypass

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolated plugin worker...

CVE-2026-104859

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859

The Nx monorepo solution for TypeScript and polyglot codebases is vulnerable to OS command injection in the @nx/docker release pipeline. In versions 21.4.0 until 22.7.8 and 23.0.0 until 23.1.1 , the release.docker.repositoryName and registryUrl configuration values are interpolated into shell com...