Executive brief
Nx, a popular build system tool, contains a vulnerability in its self-hosted remote caching feature. If an organization uses a custom or compromised remote cache server, an attacker could send a malicious file that overwrites critical system files on the developer's machine or build server. This could lead to a complete system takeover, unauthorized data access, or the execution of malicious code during the build process.
Technical details
A path traversal vulnerability (Zip-Slip) exists in the Nx self-hosted HTTP remote cache extractor. The vulnerable component fails to validate entry paths within downloaded gzipped tar archives, joining untrusted entry names directly to the output directory using an unguarded 'Entry::unpack()' call. An attacker controlling a remote cache server or performing a Man-in-the-Middle (MITM) attack can provide a crafted archive to write files outside the intended cache directory. This can be escalated to remote code execution (RCE) on the client machine. The issue is patched in Nx versions 22.7.7 and 23.0.2, while several standalone cache packages (@nx/s3-cache, etc.) are deprecated and remain vulnerable.
Affected products
- nrwl nx >= 20.8.0, < 22.7.7; >= 23.0.0, < 23.0.2
- nrwl @nx/s3-cache <= 5.0.7
- nrwl @nx/gcs-cache <= 5.0.7
- nrwl @nx/azure-cache <= 5.0.7
- nrwl @nx/shared-fs-cache <= 5.0.7
Timeline
- 2026-06-26: patched: Fix merged in PR #36116
- 2026-07-10: disclosed: Advisory published by FrozenPandaz
- 2026-08-06: advisory: Published to GitHub Advisory Database
References
- https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g
- https://github.com/nrwl/nx/pull/36116
- https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee
- https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30
- https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9
- https://api.github.com/repos/nrwl/nx/security-advisories/GHSA-vp3h-ghgh-jr7g