---
id: CVE-2026-48027
title: Nx Console is the user interface for Nx & Lerna
summary: >-
  Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious
  version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon
  after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio
  Mark…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-506
vendor: nx
product: nx_console
affected:
  - nx_console = 18.95.0
published: '2026-05-27'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48027'
references:
  - url: 'https://github.com/nrwl/nx-console/issues/3139'
    label: security-advisories@github.com
  - url: 'https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w'
    label: security-advisories@github.com
  - url: >-
      https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise
    label: security-advisories@github.com
  - url: 'https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised'
    label: security-advisories@github.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
epss: 0.01336
epssPercentile: 0.70643
kev: true
kevDateAdded: '2026-05-27'
kevDueDate: '2026-06-10'
kevRansomware: true
exploited: true
zeroDay: true
ingestedAt: '2026-10-14T20:53:12.333Z'
---

## Overview

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

## Affected

- `nx_console = 18.95.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.