{"id":"CVE-2026-48027","published":"2026-05-27T17:16:41Z","modified":"2026-10-14T20:10:00Z","title":"Nx Console Embedded Malicious Code Vulnerability","vendor":"Nx","product":"Nx Console","tier":"core","eol":null,"description":{"text":"Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.","provenance":"source","from":"NVD"},"summary":{"text":"Nx Console, the user interface for Nx and Lerna, contained an embedded malicious code flaw in its malicious 18.95.0 release, which was briefly published to the Visual Studio Marketplace and OpenVSX. An attacker could exploit this over the network with no privileges or user interaction required, and the flaw affects confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:23Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0185,"percentile":0.79087,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-05-27","dueDate":"2026-06-10","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w ; https://nvd.nist.gov/vuln/detail/CVE-2026-48027","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-05-27","exploitedFirstSeen":"2026-05-27","ransomware":true,"evidence":[{"url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/23d94b6e-e10b-4ed3-9304-fbf1858a9ac5","date":"2026-05-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-05-27"},{"url":"https://www.ic3.gov/CSA/2026/260702.pdf","date":"2026-07-02"},{"url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/07/GRIT_Q2_2026_Ransomware__Cyber_Threat_Insights_Report.pdf","date":"2026-07-09"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"references":[{"url":"https://github.com/nrwl/nx-console/issues/3139","tags":["Issue Tracking"]},{"url":"https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w","tags":["Mitigation","Vendor Advisory"]},{"url":"https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise","tags":["Vendor Advisory"]},{"url":"https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027","tags":["US Government Resource"]}],"techniques":[{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: compromised extension marketplace distribution","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"a malicious version of Nx Console, 18.95.0, was published","start":65,"end":122}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: malicious code runs in developer IDE","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Nx Console is the user interface for Nx & Lerna","start":0,"end":47}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: user installs malicious extension","mappingType":"primary_impact","evidence":[{"from":"description","quote":"malicious version of Nx Console, 18.95.0","start":67,"end":107}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"}],"reports":[{"id":"SRC-5629a83b43d088761158","title":"260702","publisher":"ic3.gov","url":"https://www.ic3.gov/CSA/2026/260702.pdf","date":null,"mentions":[{"quote":"CVE-2026-33634 CVE-2026-48027","start":5353,"end":5382}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-32550","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32550","exploited":true,"exploitedSince":"2026-05-27","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised"],"flow":[{"stage":"exploitation","techniques":["T1195.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1204.002"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2026-05-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48027","provenance":"source"},{"date":"2026-05-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/23d94b6e-e10b-4ed3-9304-fbf1858a9ac5","provenance":"source"},{"date":"2026-05-27","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-05-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32550","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":84.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 157 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":15.82,"detail":"percentile 0.7909"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}