CVE-2026-54753 Overview
CVE-2026-54753 affects Nx, a monorepo build system for TypeScript and polyglot codebases. The local HTTP server started by nx graph returns Access-Control-Allow-Origin: * on every response. Any website a developer visits can read the server's responses cross-origin. Exposed data includes the full project graph and the output of the /help endpoint, which executes a target's configured help command. The flaw primarily results in cross-origin information disclosure, but attackers can achieve arbitrary command injection in rare configurations. Versions from 17.0.4 through 22.7.1 and pre-release 23.0.0-beta.1 are affected. Nx maintainers patched the issue in versions 22.7.2 and 23.0.0-beta.2.
Critical Impact
Malicious websites can read a developer's full Nx project graph and, in some cases, trigger arbitrary command execution through the /help endpoint.
Affected Products
- Nx versions 17.0.4 through 22.7.1
- Nx pre-release version 23.0.0-beta.1
- Local nx graph HTTP server component
Discovery Timeline
- 2026-06-26 - CVE-2026-54753 published to NVD
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-54753
Vulnerability Analysis
The vulnerability is classified under [CWE-749] Exposed Dangerous Method or Function. When a developer runs nx graph, Nx launches a local HTTP server to render the project dependency graph. That server responds with the Access-Control-Allow-Origin: * header on every route. Browsers therefore permit any origin to read response bodies from the server. An attacker who lures a developer to a malicious page while the graph server is running can issue cross-origin fetch requests and receive the full project graph in response. The /help endpoint compounds the risk by executing a target's configured help command and returning its stdout, which can be triggered and read by the same cross-origin attacker.
Root Cause
The root cause is a permissive Cross-Origin Resource Sharing (CORS) configuration on a localhost development server. The server does not restrict requests to known origins such as the Nx graph UI, and it does not verify a same-origin token before returning sensitive data or executing configured commands.
Attack Vector
The attack requires the developer to run nx graph and then visit an attacker-controlled web page in the same browser session. The attacker's JavaScript issues fetch calls to the localhost port used by the Nx graph server. Because the server allows any origin, the attacker's page reads the responses, including project graph metadata and /help command output. Where the configured help command accepts user-controlled input or shell metacharacters, the attacker can trigger arbitrary command injection on the developer's workstation.
No verified proof-of-concept code is published. See the GitHub Security Advisory and the GitHub Pull Request for the technical fix.
Detection Methods for CVE-2026-54753
Indicators of Compromise
- Outbound HTTP requests from developer browsers to localhost ports used by nx graph originating from non-Nx origins.
- Unexpected process execution spawned by the Nx CLI, especially child processes launched from the /help route handler.
- Access log entries on the local graph server showing Origin headers that do not match localhost or the Nx UI.
Detection Strategies
- Inspect installed Nx versions across developer workstations and flag any release between 17.0.4 and 22.7.1, or 23.0.0-beta.1.
- Monitor endpoint telemetry for node or nx processes binding to a listener while a browser process concurrently loads untrusted origins.
- Review browser network logs during incident response for cross-origin fetch calls targeting local development ports.
Monitoring Recommendations
- Enroll developer endpoints in EDR to record process ancestry for shells launched from the Nx CLI.
- Alert on Nx /help route invocations that produce child processes with shell metacharacters in their command lines.
- Track package.json and lockfile changes in source control to confirm upgrades to patched Nx releases.
How to Mitigate CVE-2026-54753
Immediate Actions Required
- Upgrade Nx to version 22.7.2 or 23.0.0-beta.2 across all developer workstations and CI runners.
- Stop any running nx graph sessions on unpatched versions until the upgrade completes.
- Instruct developers to avoid browsing untrusted sites while an Nx graph server is active on unpatched versions.
Patch Information
Nx maintainers fixed the issue in versions 22.7.2 and 23.0.0-beta.2. The patch removes the wildcard Access-Control-Allow-Origin header and restricts cross-origin access to the graph server. Review the GitHub Pull Request and the GitHub Security Advisory for implementation details.
Workarounds
- Terminate the nx graph process immediately after use to shrink the window of exposure.
- Bind the graph server to a loopback-only interface and block external browser sessions during use.
- Audit each project's help target configuration and remove commands that accept untrusted input or invoke shell interpreters.
# Upgrade Nx to a patched release
npm install --save-dev nx@22.7.2
# or, for the pre-release track
npm install --save-dev nx@23.0.0-beta.2
# Verify installed version
npx nx --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
