{"action":"Upgrade nx to 22.7.9 or later.","affected":[{"fixed":"22.7.9","introduced":"14.6.0"},{"fixed":"23.1.2","introduced":"23.0.0"}],"component":"nx","cve_ids":["CVE-2026-104854"],"ecosystem":"npm","epss":0.00141,"exploited":false,"fixed_versions":["22.7.9","23.1.2"],"ghsa_id":"GHSA-w3vv-58gj-gw77","id":"tcs_01M5KGDQ0MCHNAM2C84ETK9A5P","modified_at":"2026-10-05T23:45:08.858652972Z","published_at":"2026-10-05T23:28:43Z","references":["https://osv.dev/vulnerability/GHSA-w3vv-58gj-gw77","https://github.com/nrwl/nx/security/advisories/GHSA-w3vv-58gj-gw77","https://nvd.nist.gov/vuln/detail/CVE-2026-104854","https://github.com/nrwl/nx/pull/36370","https://github.com/nrwl/nx/commit/3298fd8b2dd066167eb3cc0410643994a59b0bba","https://github.com/nrwl/nx/commit/63e1abb287a3d69f8ba981828a1de325d0d3dc68","https://github.com/nrwl/nx/commit/71c2253b6aac23b008e192c4e2642c42a5e07545","https://github.com/nrwl/nx","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-w3vv-58gj-gw77","url":"https://osv.dev/vulnerability/GHSA-w3vv-58gj-gw77"}],"summary":"Nx daemon and plugin worker sockets are accessible to other local users"}