CVE-2026-48027Critical· 9.8▾ Hadal⚠ Exploited in the wild0dayNx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Mark…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 0.3 · exploitation 25 · ransomware 5
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Jun 10, 2026
Last analysed / modified upstream
1.3%
Added to the CISA catalog on May 27, 2026. Federal remediation due Jun 10, 2026. View catalog ↗
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
nx_console = 18.95.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-59374Critical· 9.8"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting…
CVE-2025-30066High· 8.6tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs
GHSA-w2vw-w76x-qr89HighNx: OS command injection via git revisions and remote refs
CVE-2026-71476HighNx is a monorepo solution for TypeScript and polyglot codebases
CVE-2026-54753Medium· 5.9`nx graph` dev server permissive CORS policy
CVE-2024-3094Critical· 10.0Malicious backdoor in xz/liblzma (supply-chain compromise)