CVE-2026-48027
Nx Console Embedded Malicious Code Vulnerability - [Actively Exploited]
Description
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
INFO
Published Date :
May 27, 2026, 5:16 p.m.
Last Modified :
May 27, 2026, 8:34 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known Detected May 29, 2026
This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w ; https://nvd.nist.gov/vuln/detail/CVE-2026-48027
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 4.0 | CRITICAL | [email protected] |
Solution
- Upgrade Nx Console to version 18.100.0.
- Remove any compromised Nx Console versions.
- Verify installation integrity.
Public PoC/Exploit Available at Github
CVE-2026-48027 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48027.
| URL | Resource |
|---|---|
| https://github.com/nrwl/nx-console/issues/3139 | Issue Tracking |
| https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w | Mitigation Vendor Advisory |
| https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise | Vendor Advisory |
| https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised | Exploit Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027 | US Government Resource |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48027 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48027
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Audit CVE impact, patch status, remediation progress, and verification results across systems.
Makefile Go
Modern supply chain security for the npm ecosystem. Static + behavioral analysis that catches what npm audit, Snyk, and Socket miss — obfuscated payloads, credential stealers, conditional triggers, sandbox evasion, and worm-like propagation.
Makefile Python JavaScript PLpgSQL Go Template Shell
None
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48027 vulnerability anywhere in the article.
-
CybersecurityNews
Attackers Abuse Trusted Developer Tooling to Exfiltrate Source Code and Secrets
A wave of sophisticated supply chain attacks has put millions of software developers on high alert, with threat actors turning everyday developer tools into weapons for stealing credentials, cloud tok ... Read more
-
TheCyberThrone
CISA adds Three Vulnerabilities to KEV Catalog
May 28, 2026OverviewCISA has added three new vulnerabilities to its Known Exploited Vulnerabilities catalog:CVE-2026-8398 (Daemon Tools Lite Embedded Malicious Code)CVE-2026-45321 (TanStack Unspecifie ... Read more
The following table lists the changes that have been made to the
CVE-2026-48027 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
May. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:nx:nx_console:18.95.0:*:*:*:*:visual_studio_code:*:* Added Reference Type GitHub, Inc.: https://github.com/nrwl/nx-console/issues/3139 Types: Issue Tracking Added Reference Type GitHub, Inc.: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w Types: Mitigation, Vendor Advisory Added Reference Type GitHub, Inc.: https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise Types: Vendor Advisory Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027 Types: US Government Resource Added Reference Type GitHub, Inc.: https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 27, 2026
Action Type Old Value New Value Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027 -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
May. 27, 2026
Action Type Old Value New Value Added Date Added 2026-05-27 Added Due Date 2026-05-27 Added Required Action 2026-05-27 Added Vulnerability Name 2026-05-27 -
New CVE Received by [email protected]
May. 27, 2026
Action Type Old Value New Value Added Description Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-506 Added Reference https://github.com/nrwl/nx-console/issues/3139 Added Reference https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w Added Reference https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise Added Reference https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised