Detections
Analytics

SCA: security update for nx (GHSA-hrvq-x7jp-36xv)

medium Tenable Self-Hosted Container Security Plugin ID 473009

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx
 migration planning reads the nx-migrations.migrations value from a target package manifest without
 validating that it is a contained relative path. A hostile direct dependency or a package introduced
 through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to
 join an escaping destination onto its temporary directory. The migration archive can then write attacker-
 controlled bytes outside the temporary directory, while opening the destination stream can truncate an
 existing writable file even when no archive entry matches. This occurs during migration planning before
 review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when
 the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION,
 --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and
 23.2.1. (CVE-2026-104853)

Solution

Update the nx library and its related packages to version 22.7.10 or later.

See Also

https://github.com/advisories/GHSA-hrvq-x7jp-36xv

Plugin Details

Severity: Medium

ID: 473009

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-104853

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.8

Threat Score: 2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-104853