Detections
Analytics

SCA: security update for nx (GHSA-w3vv-58gj-gw77)

high Tenable Self-Hosted Container Security Plugin ID 472957

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx
 creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations
 without owner-only directory and socket permissions. Another unprivileged local account on a shared build
 server, developer host, or multi-user container can discover and connect to a running socket because the
 transport performs no authentication and relies on filesystem containment. The daemon's
 PROCESS_IN_BACKGROUND request accepts a module path and invokes its default export, allowing a caller that
 controls a file to execute code as the account running Nx; other handlers can expose workspace file
 contents, project graphs, and task hashes. Disabling the daemon alone does not remove the vulnerable
 plugin-worker sockets, while single-user machines without another local account are not exposed. This
 issue is fixed in versions 22.7.9 and 23.1.2. (CVE-2026-104854)

Solution

Update the nx library and its related packages to version 22.7.9 or later.

See Also

https://github.com/advisories/GHSA-w3vv-58gj-gw77

Plugin Details

Severity: High

ID: 472957

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.37

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Low

Base Score: 3.6

Temporal Score: 2.7

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-104854

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.5

Threat Score: 5.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-104854