CVE-2026-104854: Nx Monorepo Privilege Escalation Vulnerability

CVE-2026-104854 Overview

Nx is a monorepo build system for TypeScript and polyglot codebases. CVE-2026-104854 is a local privilege and code execution vulnerability affecting Nx versions 14.6.0 through 22.7.8 and 23.0.0 through 23.1.1. The daemon and isolated plugin workers create Unix domain sockets in shared temporary directories without restricting permissions to the owning user. On shared build servers, developer hosts, or multi-user containers, another unprivileged local account can connect to these sockets. The transport performs no authentication, so an attacker can invoke the daemon's PROCESS_IN_BACKGROUND request to execute arbitrary code as the Nx user. The flaw is categorized under [CWE-269: Improper Privilege Management].

Critical Impact
An unprivileged local user on a shared system can execute arbitrary code as the account running Nx and read workspace file contents, project graphs, and task hashes.

Affected Products

Nx versions 14.6.0 through 22.7.8
Nx versions 23.0.0 through 23.1.1
Nx daemon and isolated plugin workers on multi-user Unix hosts

Discovery Timeline

2026-10-02 - CVE-2026-104854 published to NVD
2026-10-02 - Last updated in NVD database
Fixed Versions Released - Nx 22.7.9 and 23.1.2

Technical Details for CVE-2026-104854

Vulnerability Analysis

Nx runs a background daemon and isolated plugin workers that communicate with Nx CLI processes over Unix domain sockets. These sockets are created inside shared temporary locations without owner-only directory and socket permissions. The transport layer relies entirely on filesystem containment for access control and performs no authentication on connecting clients.

Any local account on the same host can enumerate socket paths and open a connection to a running Nx daemon or plugin worker. Once connected, the attacker speaks the daemon's native protocol directly. The PROCESS_IN_BACKGROUND handler accepts a module path and invokes its default export, executing JavaScript under the identity of the Nx user. Additional handlers expose workspace file contents, project graphs, and task hashes to the connected client.

Root Cause

The root cause is missing restrictive permissions on the socket parent directory and the socket file itself. Nx did not apply 0700 directory modes or per-user socket paths, so sockets were world-reachable. The daemon trusted the operating system's directory boundaries instead of authenticating peer connections. Disabling the daemon alone does not remediate the issue because plugin-worker sockets remain vulnerable.

Attack Vector

Exploitation requires local access with any unprivileged account on a shared host. The attacker locates an active Nx socket under the shared temporary directory, connects to it, and sends a crafted PROCESS_IN_BACKGROUND request pointing to a module path that the attacker controls. The daemon loads the module and executes its default export in the context of the Nx user, yielding arbitrary code execution and access to that user's workspace data.

typescript

// Security patch in packages/nx/src/daemon/client/daemon-socket-messenger.ts
// fix(core): restrict daemon and plugin worker socket access to the owning user
  consumeMessagesFromSocket,
  MESSAGE_END_SEQ,
} from '../../utils/consume-messages-from-socket';
+import { workspaceRoot } from '../../utils/workspace-root';
import { clientLogger } from '../logger';
import { DaemonMessage } from '../message-types/daemon-message';
import { serialize } from '../socket-utils';

Source: GitHub Commit 3298fd8

Detection Methods for CVE-2026-104854

Indicators of Compromise

Unexpected child processes spawned by the Nx daemon or node processes running under the Nx user account.
Connections to Nx Unix domain sockets from process identifiers that do not belong to the socket owner.
Unusual reads of workspace files, .nx/cache artifacts, or project graph outputs by non-owner accounts.

Detection Strategies

Audit socket permissions under the Nx temporary directory and flag any sockets or parent directories that are not mode 0700 and owned by the expected user.
Monitor connect() syscalls to Nx socket paths and correlate the connecting UID with the socket owner's UID.
Review process execution telemetry for node processes loading modules from paths outside the workspace or user home directory.

Monitoring Recommendations

Enable Linux audit rules on /tmp and configured Nx cache directories to log socket creation and access events.
Collect endpoint process ancestry to spot code execution chains originating from the Nx daemon on shared build hosts.
Baseline normal Nx daemon behavior per build agent so anomalous outbound network connections or file writes stand out.

How to Mitigate CVE-2026-104854

Immediate Actions Required

Upgrade Nx to version 22.7.9 or 23.1.2 on every shared build server, CI runner, developer workstation, and multi-user container image.
Terminate any running Nx daemons and remove existing sockets after upgrading using nx reset to force recreation with the fixed permissions.
Inventory multi-user hosts that run Nx and prioritize them for patching, since single-user machines without another local account are not exposed.

Patch Information

The fix is tracked in GitHub Security Advisory GHSA-w3vv-58gj-gw77 and delivered in Nx Release 22.7.9 and Nx Release 23.1.2. The underlying code changes land in GitHub Pull Request #36370 with commits 3298fd8, 63e1abb, and 71c2253. The patches restrict daemon and plugin worker socket access to the owning user and bind sockets inside a workspace-scoped path.

Workarounds

Run Nx builds only on single-user hosts or inside per-user containers until the patched version is deployed.
Restrict access to shared build servers so no untrusted local accounts coexist with the account running Nx.
Note that disabling the daemon via NX_DAEMON=false is insufficient because plugin-worker sockets remain vulnerable.

bash

# Upgrade Nx to a fixed release and reset daemon state
npm install --save-dev nx@22.7.9   # or nx@23.1.2
npx nx reset

# Verify socket permissions after restart (should be 0700 and owned by the Nx user)
ls -la "$(dirname "$(lsof -U -a -c node 2>/dev/null | awk '/nx/ {print $NF; exit}')")"