Is CVE-2026-54753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54753 being exploited in the wild.

How severe is CVE-2026-54753?

Medium severity, with a CVSS score of 5.9, published 26 June 2026.

Which products and versions are affected?

nx (npm) SEMVER:introduced=17.0.4,fixed=22.7.2; Nrwl Nx >= 17.0.4, = 23.0.0-beta.0, < 23.0.0-beta.2.

Is there a fix for CVE-2026-54753?

Yes. nx (npm): upgrade to 22.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54753 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54753?

Check whether you run nx (npm) or Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54753: Nrwl Nx permissive CORS policy in nx graph dev server

Q: Is there a fix for CVE-2026-54753?

Yes. nx (npm): upgrade to 22.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54753 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54753?

Check whether you run nx (npm) or Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54753 · Severity: medium · CVSS 5.9 · Published 2026-06-26

Nx, a popular development tool for managing large codebases, contains a security flaw in its visualization server. When a developer runs the 'nx graph' command locally, the server uses a overly permissive security policy that allows any website the developer visits to read sensitive information about their project's structure and configuration. In specific scenarios where a project already contains malicious code, this could potentially be used to execute unauthorized commands on the developer's machine.

Technologies: nx (npm), Nrwl Nx. Vendors: npm, Nrwl.

Quick answers

Is CVE-2026-54753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54753 being exploited in the wild.
How severe is CVE-2026-54753?: Medium severity, with a CVSS score of 5.9, published 26 June 2026.
Which products and versions are affected?: nx (npm) SEMVER:introduced=17.0.4,fixed=22.7.2; Nrwl Nx >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2.
Is there a fix for CVE-2026-54753?: Yes. nx (npm): upgrade to 22.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54753 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54753?: Check whether you run nx (npm) or Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nx (npm): upgrade to 22.7.2 or later
```
npm install nx@22.7.2
```

Technical details

The local HTTP server started by `nx graph` (defaulting to port 4211) implements a permissive CORS policy by sending `Access-Control-Allow-Origin: *` on all responses. This allows a malicious website visited by a developer to perform cross-origin reads of the server's responses using standard fetch requests. Impacted data includes the full project graph (file paths, dependencies, and build configurations) and the output of the `/help` endpoint. The `/help` endpoint executes configured commands via `execSync`; while these commands are not directly attacker-controlled via the request, a malicious actor could trigger them if a malicious target already exists in the workspace configuration. The vulnerability is fixed in versions 22.7.2 and 23.0.0-beta.2 by removing the wildcard header.

Affected products

nrwl nx >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2

Identifiers

CVE-2026-54753
GHSA-g2r8-wvmj-jf5w

Timeline

2026-06-09: advisory: Initial internal advisory published by FrozenPandaz
2026-06-26: kev added: Published to the National Vulnerability Database (NVD)
2026-07-31: disclosed: GitHub Advisory GHSA-g2r8-wvmj-jf5w published/updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.