Vulnerabilities CVE-2026-48027

CVE-2026-48027

Critical

Open

KEV

TLP:CLEAR

Compromised Nx Console version 18.95.0

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

Details

CVSS Score: 9.3
EPSS Score ⓘ: 1.85%

77.1th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Confidence: 100%
Published: May 27, 2026
Last Modified: Aug 4, 2026
CISA KEV
Date Added: May 27, 2026
Patch Due: Jun 10, 2026
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.