# CVE-2026-48027: nrwl Nx Console Malicious Code Injection in VSCode Extension

Source: https://junglewise.ai/threats/cve-2026-48027-nrwl-nx-console-malicious-code-injection-in-vscode-extension  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-48027 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2026-05-27

A supply chain attack has compromised the Nx Console extension for Visual Studio Code and various GitHub Action workflows. Attackers used a malicious update to the extension to gain access to developer devices and steal internal source code. Additionally, a separate campaign known as 'Megalodon' has been injecting malicious code into GitHub workflows to steal sensitive cloud credentials and security tokens from public repositories.

Vendors: [GitHub](https://junglewise.ai/threats/vendors/github), [Nrwl](https://junglewise.ai/threats/vendors/nrwl).

## Quick answers

**Is CVE-2026-48027 exploited in the wild?** Yes. CVE-2026-48027 is known to be exploited in the wild, first recorded on 27 May 2026. Treat it as urgent.

**How severe is CVE-2026-48027?** Critical severity, with a CVSS score of 9.3, published 27 May 2026.

**Which products and versions are affected?** GitHub Actions All versions impacted by malicious workflows; Nrwl Nx Console 18.95.0.

**Is there a fix for CVE-2026-48027?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48027 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48027?** Check whether you run GitHub Actions or Nrwl Nx Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This advisory covers two distinct supply chain intrusion campaigns. In the first, attackers compromised the Nx developer ecosystem to release a poisoned version (18.95.0) of the Nx Console VS Code extension. This malicious version was distributed via the VS Code automatic update mechanism, allowing for unauthorized access to developer machines and the exfiltration of internal GitHub repositories. In the second campaign, dubbed 'Megalodon,' threat actors injected malicious GitHub Action workflows into public repositories. These workflows were designed to harvest CI/CD secrets, cloud credentials (AWS, GCP, Azure), and various authentication tokens. Organizations are advised to audit workflow files, rotate all secrets accessible to CI/CD pipelines, and pin software to specific trusted versions.

## Affected products

- Nrwl / Nx Nx Console extension for VS Code 18.95.0
- GitHub GitHub Actions All versions impacted by malicious workflows

## Timeline

- 2026-05-18: exploited: Earliest date of unauthorized changes identified in the Megalodon campaign.
- 2026-05-28: advisory: CISA published the alert regarding the supply chain compromises.
- 2026-05-28: kev added: CVE-2026-48027 added to CISA KEV catalog.

## References

- [https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories](https://www.cisa.gov/news-events/alerts/2026/05/28/supply-chain-compromises-impact-nx-console-and-github-repositories)