{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.0.0"}],"component":"@nx/azure-cache","cve_ids":["CVE-2025-36852"],"ecosystem":"npm","epss":0.0026,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-rrr2-jcr8-7q3x","id":"tcs_01M5KG9TBHZ3NEDP8NZ60PR8J6","modified_at":"2025-10-14T21:42:31.410395Z","published_at":"2025-06-10T21:31:23Z","references":["https://osv.dev/vulnerability/GHSA-rrr2-jcr8-7q3x","https://nvd.nist.gov/vuln/detail/CVE-2025-36852","https://github.com/nrwl/nx","https://nx.app/files/cve-2025-06","https://nx.dev/blog/creep-vulnerability-build-cache-security","https://nx.dev/docs/reference/remote-cache-plugins/azure-cache/overview"],"severity":{"label":"critical","score":9.4},"sources":[{"source":"osv","source_id":"GHSA-rrr2-jcr8-7q3x","url":"https://osv.dev/vulnerability/GHSA-rrr2-jcr8-7q3x"},{"source":"nvd","source_id":"CVE-2025-36852","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-36852"}],"summary":"@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests"}