CVE-2026-48027
Nx Console Embedded Malicious Code Vulnerability
Description
CVE-2026-48027 is a critical supply chain vulnerability in Nx Console, the user interface for Nx and Lerna, caused by embedded malicious code. On 19 May 2026, a trojanized version of Nx Console (18.95.0) was published to the Visual Studio Marketplace and OpenVSX, remaining available for roughly 18 to 36 minutes before removal. Any developer who installed or auto-updated to the malicious version during that window executed attacker-controlled code in their development environment, exposing local secrets, source code and credentials. With a CVSS score of 9.8, a CISA KEV listing, and known association with ransomware activity, CVE-2026-48027 is a high-priority threat — affected users must upgrade to the clean Nx Console release 18.100.0 immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| nx | nx console | 18.95.0 |
References
- https://github.com/nrwl/nx-console/issues/3139(Issue Tracking)
- https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w(Mitigation, Vendor Advisory)
- https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise(Vendor Advisory)
- https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027(US Government Resource)
Weakness Type
CWE-506: Embedded Malicious Code
Embedded malicious code is application code that performs an unauthorized or malicious action that was intentionally introduced into the software — here, by an attacker who published a trojanized build of Nx Console. Because the malicious logic ships inside an otherwise trusted extension, it runs with the full privileges of the developer's environment the moment the compromised version is installed.
Learn more: CWE-506 — Embedded Malicious Code
Impact Analysis
CVE-2026-48027 carries a CVSS 3.1 score of 9.8 (CRITICAL). The CVSS vector describes an attack that is remotely exploitable (Attack Vector: Network), low-complexity (Attack Complexity: Low), requires no privileges (Privileges Required: None) and no user interaction beyond the routine act of installing or auto-updating the extension (User Interaction: None), with High impact to confidentiality, integrity and availability. In practice, the embedded malicious code in Nx Console 18.95.0 ran with the developer's permissions and could harvest credentials, tokens and source code and tamper with the local environment. The EPSS score of 26.8% sits in the 96.4th percentile — among the most likely vulnerabilities to be exploited — and CISA has flagged this entry as associated with ransomware campaigns, underscoring that compromised developer machines are being used as a beachhead for broader attacks.
Exploit Maturity
CVE-2026-48027 is not a latent flaw awaiting a proof-of-concept — it is a realized supply chain compromise. The malicious Nx Console 18.95.0 was actively distributed through the Visual Studio Marketplace and OpenVSX, and CISA has added the CVE to its Known Exploited Vulnerabilities catalog and flagged it as associated with ransomware. A third-party analysis with indicators of compromise is publicly available from StepSecurity, and the vendor has published a detailed postmortem with IOCs at nx.dev. The EPSS score of 26.8% (96.4th percentile) reflects this elevated, real-world exploitation activity. Anyone who installed or updated Nx Console around 19 May 2026 should assume compromise and act immediately.
Remediation
- Apply mitigations per vendor instructions as mandated by the CISA KEV deadline of 2026-06-10, and follow the vendor security advisory GHSA-c9j4-9m59-847w.
- Upgrade Nx Console to version 18.100.0, which the vendor confirms is not compromised; uninstall and remove any trace of the malicious 18.95.0 build from every developer machine.
- Treat any environment that ran 18.95.0 as compromised: rotate all credentials, API tokens, SSH keys and cloud secrets that were accessible from that machine, and review the published indicators of compromise.
- Hunt for malicious activity — outbound connections to attacker infrastructure, exfiltration of tokens, and unauthorized use of the rotated credentials — across CI/CD systems and repositories the affected developers could reach.
- As long-term hardening against embedded malicious code, pin extension and dependency versions, disable silent auto-updates for security-sensitive tooling, and verify the integrity and provenance of editor extensions before deployment.
Technical Details
CVE-2026-48027 is an instance of embedded malicious code (CWE-506): rather than exploiting a logic flaw, the attacker published a build of Nx Console that contained intentionally hostile code. The compromised 18.95.0 release was available in the Visual Studio Marketplace from 12:30 to 12:48 PM UTC (~18 minutes) and in OpenVSX from 12:33 to 13:09 UTC (~36 minutes) on 19 May 2026. Because an editor extension executes within the IDE with the developer's privileges, the malicious code could read the local filesystem, environment variables and stored credentials and communicate with external infrastructure. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-delivered, unauthenticated compromise with high impact across confidentiality, integrity and availability; the fix is simply to move to the uncompromised 18.100.0 release.
Frequently Asked Questions
Is CVE-2026-48027 being actively exploited?
Yes. CVE-2026-48027 is a realized supply chain attack: the malicious Nx Console 18.95.0 was distributed to real users, and CISA has listed it on the Known Exploited Vulnerabilities catalog and flagged it as associated with ransomware. Its EPSS score of 26.8% (96.4th percentile) further reflects very high exploitation likelihood.
What products are affected by CVE-2026-48027?
The affected product is Nx Console version 18.95.0 — the trojanized build briefly published to the Visual Studio Marketplace and OpenVSX on 19 May 2026. Version 18.100.0 is not compromised.
How do I fix CVE-2026-48027?
Upgrade Nx Console to 18.100.0 and remove the malicious 18.95.0 build. Because the code ran with developer privileges, also rotate all credentials accessible from any affected machine and review the vendor's published indicators of compromise.
How severe is CVE-2026-48027?
CVE-2026-48027 is rated CRITICAL with a CVSS 3.1 score of 9.8. It allowed attacker-controlled code to execute in developers' environments with high confidentiality, integrity and availability impact, is confirmed exploited by CISA, and is associated with ransomware — making it a top-priority remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.