CVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
Other sources
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nx Consoleto a version that resolves this vulnerability.Fixed in 18.100.0 - Compensating control
If upgrading to Nx Console 18.100.0 is not immediately possible, discontinue use of Nx Console for Nx & Lerna until mitigations are available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48027?
CVE-2026-48027 has a critical severity rating of 9.3 according to the CVSS score.
How do I fix CVE-2026-48027?
To remediate CVE-2026-48027, apply mitigations as per vendor instructions or discontinue use of the Nx Console product if mitigations are unavailable.
What are the risks associated with CVE-2026-48027?
CVE-2026-48027 poses a high risk as it allows for credential harvesting from multiple sources, potentially leading to ransomware attacks.
Is CVE-2026-48027 actively being exploited?
Yes, CVE-2026-48027 is documented as exploited in the wild as of May 27, 2026.
What kind of systems are affected by CVE-2026-48027?
CVE-2026-48027 affects the Nx Console embedded in Nrwl Nx Console and other related tools, including Visual Studio Code.