CVE-2026-54753

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54753", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:12:41.965Z", "datePublished": "2026-06-26T18:13:34.371Z", "dateUpdated": "2026-06-26T19:09:33.257Z"}, "containers": {"cna": {"title": "Nx: `nx graph` dev server permissive CORS policy", "problemTypes": [{"descriptions": [{"cweId": "CWE-749", "lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"}, {"name": "https://github.com/nrwl/nx/pull/35494", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/pull/35494"}], "affected": [{"vendor": "nrwl", "product": "nx", "versions": [{"version": ">= 17.0.4, < 22.7.2", "status": "affected"}, {"version": ">= 23.0.0-beta.0, < 23.0.0-beta.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T18:13:34.371Z"}, "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."}], "source": {"advisory": "GHSA-g2r8-wvmj-jf5w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-26T19:09:19.972525Z", "id": "CVE-2026-54753", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T19:09:33.257Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54753", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T19:09:19.972525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-26T19:09:25.959Z"}}], "cna": {"title": "Nx: `nx graph` dev server permissive CORS policy", "source": {"advisory": "GHSA-g2r8-wvmj-jf5w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nrwl", "product": "nx", "versions": [{"status": "affected", "version": ">= 17.0.4, < 22.7.2"}, {"status": "affected", "version": ">= 23.0.0-beta.0, < 23.0.0-beta.2"}]}], "references": [{"url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w", "name": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nrwl/nx/pull/35494", "name": "https://github.com/nrwl/nx/pull/35494", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-26T18:13:34.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54753", "state": "PUBLISHED", "dateUpdated": "2026-06-26T19:09:33.257Z", "dateReserved": "2026-06-15T23:12:41.965Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-26T18:13:34.371Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nx", "vendor": "nrwl", "versions": [{"status": "affected", "version": ">= 17.0.4, < 22.7.2"}, {"status": "affected", "version": ">= 23.0.0-beta.0, < 23.0.0-beta.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2."}, {"lang": "es", "value": "Nx es una soluci\u00f3n de monorepo para bases de c\u00f3digo TypeScript y pol\u00edglotas. Desde 17.0.4 hasta 22.7.2 y 23.0.0-beta.2, el servidor HTTP local iniciado por nx graph envi\u00f3 Access-Control-Allow-Origin: * en cada respuesta, permitiendo que cualquier sitio web que un desarrollador visitara leyera las respuestas del servidor de origen cruzado - incluyendo el grafo completo del proyecto y la salida del endpoint /help, que ejecuta el comando de ayuda configurado de un objetivo. El impacto pr\u00e1ctico es t\u00edpicamente revelaci\u00f3n de informaci\u00f3n de origen cruzado, pero puede ser inyecci\u00f3n de comandos arbitraria en casos raros. Esta vulnerabilidad est\u00e1 corregida en 22.7.2 y 23.0.0-beta.2."}], "id": "CVE-2026-54753", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54753", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-26T19:09:19.972525Z", "version": "2.0.3"}}]}, "published": "2026-06-26T19:16:43.937", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/pull/35494"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-749"}, {"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Nx: Nx: `nx graph` dev server permissive CORS policy", "id": "2493647", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493647"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin \u2014 including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.", "A flaw was found in Nx, a monorepo solution for managing multiple projects. The local HTTP server, started by the `nx graph` command, incorrectly sent an `Access-Control-Allow-Origin: *` header in its responses. This misconfiguration allows a remote attacker to read sensitive project information, such as the full project graph, from a developer's system when they visit a malicious website. In rare cases, this vulnerability could also lead to arbitrary command injection."], "name": "CVE-2026-54753", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-gateway", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "automation-platform-ui", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-06-26T18:13:34Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54753\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54753\nhttps://github.com/nrwl/nx/pull/35494\nhttps://github.com/nrwl/nx/security/advisories/GHSA-g2r8-wvmj-jf5w"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.4,22.7.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0-beta.0,23.0.0-beta.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nx", "source": "cna", "vendor": "nrwl"}, "product": "nx", "vendor": "nrwl"}], "created": "2026-06-26T20:30:06.197789+00:00", "updated": "2026-08-03T07:15:04.354349+00:00", "vendors": ["nrwl", "nrwl$PRODUCT$nx"]}