CVE-2026-104853: Nx Monorepo Path Traversal Vulnerability

CVE-2026-104853 Overview

CVE-2026-104853 is a path traversal vulnerability [CWE-22] in Nx, a monorepo build system for TypeScript and polyglot codebases. The flaw affects Nx versions from 13.10.0 up to 22.7.10 and 23.2.1. During migration planning, Nx reads the nx-migrations.migrations value from a target package manifest without validating that the path stays within the intended directory. A hostile dependency, or a package introduced through a trusted packageGroup, can supply .. segments or an absolute path. This causes nx migrate to join an escaping destination onto its temporary directory, enabling writes outside that location.

Critical Impact
Attacker-controlled packages can write arbitrary bytes outside the migration temporary directory and truncate existing writable files on the developer's machine before any migration is reviewed or executed.

Affected Products

Nx versions 13.10.0 through 22.7.9
Nx versions 23.0.0 through 23.2.0
Projects consuming Nx via dependencies or packageGroup entries

Discovery Timeline

2026-10-02 - CVE-2026-104853 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104853

Vulnerability Analysis

The vulnerability exists in Nx migration planning logic. Nx reads the nx-migrations.migrations field from a package's manifest and joins it onto a temporary directory path. The code did not verify that the resulting path remained contained within that directory. An attacker-controlled dependency can therefore specify a relative path with .. segments or an absolute path to redirect the write destination outside the sandbox.

The damage occurs in two ways. First, the migration archive extraction writes attacker-controlled bytes to the escaping destination. Second, opening the destination write stream truncates the target file to zero bytes even when no archive entry matches. This corrupts existing writable files on the developer's machine during migration planning, before the user reviews the migration list or passes --run-migrations.

Root Cause

The root cause is missing validation of relative paths parsed from untrusted package manifests. path.join silently treats absolute paths as replacements rather than appended fragments, so an absolute input bypasses naive .. checks. The upstream fix introduces an isContainedRelativePath helper that rejects absolute paths and any normalized path beginning with ...

Attack Vector

Exploitation requires that a hostile package be installed as a direct dependency or pulled in through a trusted package's packageGroup. The vulnerable installed Nx copy is reached when the standard nx@latest handoff is bypassed via NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or a fallback triggered by a temporary-install failure.

typescript

// Patch: packages/nx/src/utils/path.ts
// Source: https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f

/**
 * True when `relativePath` stays inside the directory it is resolved against.
 * Absolute paths are rejected because `path.join` silently treats them as
 * relative, so they would otherwise slip past a `..` check.
 */
export function isContainedRelativePath(relativePath: string): boolean {
  if (path.isAbsolute(relativePath)) {
    return false;
  }
  const normalized = path.normalize(relativePath);
  return !(
    normalized === '..' ||
    normalized.startsWith(`..${path.sep}`) ||
    normalized.startsWith(`..${path.posix.sep}`)
  );
}

The fix wires isContainedRelativePath into packages/nx/src/utils/package-json.ts and packages/nx/src/command-line/migrate/prompt-files.ts to validate the migrations path before extraction. See GitHub Pull Request #36887.

Detection Methods for CVE-2026-104853

Indicators of Compromise

Unexpected file writes or zero-byte truncations in developer home directories, source trees, or shell startup files immediately after an nx migrate invocation.
Package manifests in node_modules containing nx-migrations.migrations values with .. segments or absolute paths such as /etc/ or C:\\.
Presence of environment variables NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, or --run-id flags in CI logs where they were not previously used.

Detection Strategies

Audit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for installed Nx versions below 22.7.10 or 23.2.1.
Scan dependency manifests for nx-migrations entries whose migrations field is not a contained relative path.
Inspect CI and developer shell history for nx migrate invocations that preceded unexpected file modifications.

Monitoring Recommendations

Enable file integrity monitoring on developer workstations and build agents for files outside project workspaces that are touched by Node.js processes.
Alert on write operations by node processes to paths above the current project root during package manager or Nx CLI execution.
Log and review usage of the NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, and NX_MIGRATE_CLI_VERSION environment variables in CI pipelines.

How to Mitigate CVE-2026-104853

Immediate Actions Required

Upgrade Nx to version 22.7.10 or 23.2.1 across all workspaces, CI runners, and developer machines.
Avoid running nx migrate against untrusted dependency updates until all installed Nx copies have been patched.
Review recently added direct dependencies and transitive packages introduced via packageGroup for suspicious nx-migrations values.

Patch Information

The maintainers resolved the issue in GitHub Release 22.7.10 and GitHub Release 23.2.1. The fix is implemented across commits 38cd82a0, 95474ab4, and de37c5eb. Full details are documented in GitHub Security Advisory GHSA-hrvq-x7jp-36xv.

Workarounds

Do not set NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, or NX_MIGRATE_CLI_VERSION, and avoid --run-id, so that the nx@latest handoff fetches a patched Nx CLI.
Pin trusted dependency versions and disable automated migration planning in CI until the upgrade is complete.
Run nx migrate only inside ephemeral, least-privilege sandboxes where arbitrary file writes have limited blast radius.

bash

# Upgrade Nx to a fixed release
npm install --save-dev nx@23.2.1
# or for the 22.x line
npm install --save-dev nx@22.7.10

# Verify the installed version
npx nx --version