# CVE-2026-54753: Nrwl Nx permissive CORS policy in nx graph dev server

Source: https://junglewise.ai/threats/cve-2026-54753-nrwl-nx-permissive-cors-policy-in-nx-graph-dev-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-54753 · Severity: medium · CVSS 5.9 · Published 2026-06-26

Nx, a popular development tool for managing large codebases, contains a security flaw in its visualization server. When a developer runs the 'nx graph' command locally, the server uses a overly permissive security policy that allows any website the developer visits to read sensitive information about their project's structure and configuration. In specific scenarios where a project already contains malicious code, this could potentially be used to execute unauthorized commands on the developer's machine.

Technologies: [nx (npm)](https://junglewise.ai/threats/technologies/npm-nx), [Nrwl Nx](https://junglewise.ai/threats/technologies/nx). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nrwl](https://junglewise.ai/threats/vendors/nrwl).

## Quick answers

**Is CVE-2026-54753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54753 being exploited in the wild.

**How severe is CVE-2026-54753?** Medium severity, with a CVSS score of 5.9, published 26 June 2026.

**Which products and versions are affected?** nx (npm) SEMVER:introduced=17.0.4,fixed=22.7.2; Nrwl Nx >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2.

**Is there a fix for CVE-2026-54753?** Yes. nx (npm): upgrade to 22.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54753?** Check whether you run nx (npm) or Nrwl Nx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nx (npm): upgrade to 22.7.2 or later

  ```sh
  npm install nx@22.7.2
  ```


## Technical details

The local HTTP server started by `nx graph` (defaulting to port 4211) implements a permissive CORS policy by sending `Access-Control-Allow-Origin: *` on all responses. This allows a malicious website visited by a developer to perform cross-origin reads of the server's responses using standard fetch requests. Impacted data includes the full project graph (file paths, dependencies, and build configurations) and the output of the `/help` endpoint. The `/help` endpoint executes configured commands via `execSync`; while these commands are not directly attacker-controlled via the request, a malicious actor could trigger them if a malicious target already exists in the workspace configuration. The vulnerability is fixed in versions 22.7.2 and 23.0.0-beta.2 by removing the wildcard header.

## Affected products

- nrwl nx >= 17.0.4, < 22.7.2; >= 23.0.0-beta.0, < 23.0.0-beta.2

## Identifiers

- CVE-2026-54753
- GHSA-g2r8-wvmj-jf5w

## Timeline

- 2026-06-09: advisory: Initial internal advisory published by FrozenPandaz
- 2026-06-26: kev added: Published to the National Vulnerability Database (NVD)
- 2026-07-31: disclosed: GitHub Advisory GHSA-g2r8-wvmj-jf5w published/updated

## References

- [https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w](https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w)
- [https://github.com/nrwl/nx/pull/35494](https://github.com/nrwl/nx/pull/35494)
- [https://github.com/nrwl/nx/commit/7620c1ffe598086ce5e66457c7e6e38799bb499d](https://github.com/nrwl/nx/commit/7620c1ffe598086ce5e66457c7e6e38799bb499d)
- [https://github.com/nrwl/nx/commit/e59122c5569cf201561b9995ce4e34a304f4fb03](https://github.com/nrwl/nx/commit/e59122c5569cf201561b9995ce4e34a304f4fb03)
- [https://github.com/nrwl/nx/releases/tag/22.7.2](https://github.com/nrwl/nx/releases/tag/22.7.2)

## Related threats

- [Nx shell injection in Maven and Gradle plugins](https://junglewise.ai/threats/cve-2026-119282-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)
- [Nx OS command injection via git revisions and remote refs](https://junglewise.ai/threats/nx-os-command-injection-via-git-revisions-and-remote-refs-0ec6868f)
- [Nx @nx/docker shell injection in release pipeline](https://junglewise.ai/threats/cve-2026-104859-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)
- [Nx monorepo daemon and plugin worker socket privilege escalation](https://junglewise.ai/threats/cve-2026-104854-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)
- [Nx path traversal in migrate](https://junglewise.ai/threats/cve-2026-104853-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)