nx 22.6.0-canary.20260311-e206a0d

Direct Vulnerabilities

Known vulnerabilities in the nx package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Symlink Attack nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Symlink Attack via the extraction process. An attacker can write arbitrary files to locations outside the intended directory by supplying a crafted tar archive with malicious entries. This can lead to remote code execution if the attacker is able to control the contents of the extracted files. How to fix Symlink Attack? Upgrade `nx` to version 22.7.7, 23.0.2, 23.1.0-beta.5 or higher.	>=20.8.0 <22.7.7>=23.0.0 <23.0.2>=23.1.0-beta.0 <23.1.0-beta.5
M Exposed Dangerous Method or Function nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the local HTTP server's permissive CORS policy, which sends `Access-Control-Allow-Origin: *` on every response. An attacker can access sensitive information, such as the full project graph and the output of the `/help` endpoint, by enticing a developer to visit a malicious website that makes cross-origin requests to the local server. In rare cases, this can also lead to arbitrary command execution if the `/help` endpoint is abused. How to fix Exposed Dangerous Method or Function? Upgrade `nx` to version 22.7.2, 23.0.0-beta.2 or higher.	>=17.0.4 <22.7.2>=23.0.0-beta.0 <23.0.0-beta.2

Vulnerability

Vulnerable Version

Symlink Attack

nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

Affected versions of this package are vulnerable to Symlink Attack via the extraction process. An attacker can write arbitrary files to locations outside the intended directory by supplying a crafted tar archive with malicious entries. This can lead to remote code execution if the attacker is able to control the contents of the extracted files.

How to fix Symlink Attack?

Upgrade nx to version 22.7.7, 23.0.2, 23.1.0-beta.5 or higher.

>=20.8.0 <22.7.7>=23.0.0 <23.0.2>=23.1.0-beta.0 <23.1.0-beta.5

Exposed Dangerous Method or Function

nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the local HTTP server's permissive CORS policy, which sends Access-Control-Allow-Origin: * on every response. An attacker can access sensitive information, such as the full project graph and the output of the /help endpoint, by enticing a developer to visit a malicious website that makes cross-origin requests to the local server. In rare cases, this can also lead to arbitrary command execution if the /help endpoint is abused.

How to fix Exposed Dangerous Method or Function?

Upgrade nx to version 22.7.2, 23.0.0-beta.2 or higher.

>=17.0.4 <22.7.2>=23.0.0-beta.0 <23.0.0-beta.2

nx@22.6.0-canary.20260311-e206a0d

The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically