Nrwl vulnerabilities
We track 5 vulnerabilities in Nrwl products across 2 products. 5 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 29, 2026.
Latest Nrwl vulnerabilities
- 7.3 High severity
nx: Improper Neutralization of Special Elements used in an OS Command
Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin optio
- 7.3 High severity
nx: Improper Neutralization of Special Elements used in an OS Command
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.re
- 8.5 High severity
nx: Improper Privilege Management
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and socket permissions. A
- 8.7 High severity
nx: Improper Limitation of a Pathname to a Restricted Directory
Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) r
- 9.8 Critical severity
Nx Console Embedded Malicious Code Exploited
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, t