CVE-2026-48027criticalunder attackransomwareCWE-506

CVE-2026-48027: critical vulnerability in nrwl nx-console

Compromised Nx Console version 18.95.0

Published · Updated

Follow this CVE+ Monitor nx-console+ Monitor Nx Console

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

58Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and 4 threat group(s) use it.

ssvc Actcvss 9.3epss 1.8%
from disclosure to weapon
Published on NVDMay 27
CISA KEVMay 27
Action required by CISAfederal deadline: 2026-06-10

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A malicious version of Nx Console (18.95.0) was briefly published on extension marketplaces for about 18–36 minutes before removal. If installed during this window, it could compromise your development environment and system security.

Technical detail

CWE-506 (Embedded Malicious Code): A trojanized Nx Console 18.95.0 was distributed via Visual Studio Marketplace (18 min exposure) and OpenVSX (36 min exposure). The compromised extension could execute arbitrary code within the IDE and user's development workflows. Remediation requires upgrading to version 18.100.0 or later.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
nrwl · nx-console