Executive brief
Nx, a popular development tool for managing large codebases, contains a security flaw in its visualization server. When a developer runs the 'nx graph' command locally, the server uses a overly permissive security policy that allows any website the developer visits to read sensitive information about their project's structure and configuration. In specific scenarios where a project already contains malicious code, this could potentially be used to execute unauthorized commands on the developer's machine.
Technical details
The local HTTP server started by `nx graph` (defaulting to port 4211) implements a permissive CORS policy by sending `Access-Control-Allow-Origin: *` on all responses. This allows a malicious website visited by a developer to perform cross-origin reads of the server's responses using standard fetch requests. Impacted data includes the full project graph (file paths, dependencies, and build configurations) and the output of the `/help` endpoint. The `/help` endpoint executes configured commands via `execSync`; while these commands are not directly attacker-controlled via the request, a malicious actor could trigger them if a malicious target already exists in the workspace configuration. The vulnerability is fixed in versions 22.7.2 and 23.0.0-beta.2 by removing the wildcard header.
Affected products
- nrwl nx >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2
Timeline
- 2026-06-09: advisory: Initial internal advisory published by FrozenPandaz
- 2026-06-26: kev added: Published to the National Vulnerability Database (NVD)
- 2026-07-31: disclosed: GitHub Advisory GHSA-g2r8-wvmj-jf5w published/updated