{"action":"Upgrade nx to 22.7.10 or later.","affected":[{"fixed":"22.7.10","introduced":"13.10.0"},{"fixed":"23.2.1","introduced":"23.0.0"}],"component":"nx","cve_ids":["CVE-2026-104853"],"ecosystem":"npm","epss":0.00172,"exploited":false,"fixed_versions":["22.7.10","23.2.1"],"ghsa_id":"GHSA-hrvq-x7jp-36xv","id":"tcs_01M5KFW0YW28RH0ZNB5QZRAEXQ","modified_at":"2026-10-05T23:45:08.231333021Z","published_at":"2026-10-05T23:28:35Z","references":["https://osv.dev/vulnerability/GHSA-hrvq-x7jp-36xv","https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv","https://nvd.nist.gov/vuln/detail/CVE-2026-104853","https://github.com/nrwl/nx/pull/36887","https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f","https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90","https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f","https://github.com/nrwl/nx","https://github.com/nrwl/nx/releases/tag/22.7.10","https://github.com/nrwl/nx/releases/tag/23.2.1"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-hrvq-x7jp-36xv","url":"https://osv.dev/vulnerability/GHSA-hrvq-x7jp-36xv"},{"source":"nvd","source_id":"CVE-2026-104853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104853"}],"summary":"Nx: Path traversal in nx migrate package-migrations extraction"}