{"items":[{"id":"NVI-00015292","kind":"vulnerability","title":"`nx graph` dev server permissive CORS policy","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-g2r8-wvmj-jf5w","CVE-2026-54753"],"plain_summary":"GitHub lists this reviewed advisory for nx, nx. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-54a435052772d4da68aed5651e13e66c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-31T16:50:25.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-54a435052772d4da68aed5651e13e66c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-54a435052772d4da68aed5651e13e66c","url":"https://github.com/advisories/GHSA-g2r8-wvmj-jf5w","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-g2r8-wvmj-jf5w","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T09:58:49.818Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-54a435052772d4da68aed5651e13e66c"],"technology":"nx","known_exclusions":[],"conditions_summary":"## Summary\n\nThe local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the `/help` endpoint, which runs a target's configured help command. The practical impact is typically **cross-origin information disclosure**, but can be arbitrary command injection in rare cases.\n\n## Severity\n\n\nExploitation requires the developer to be running `nx graph` and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).\n\n## Affected & Patched Versions\n\nPackage: `nx` (npm).\n\n- **Affected:** `>= 17.0.4, = 23.0.0-beta.0, < 23.0.0-beta.2`\n- **Patched:** `22.7.2`+ (backport) and `23.0.0` (first in `23.0.0-beta.2`)\n\nThe wildcard CORS header was introduced in `17.0.4`; the `/help` execution endpoint in `19.4.0`. **The `21.x` line is not patched** — `21.x` users should upgrade to `22.7.2` or later.\n\n## Details\n\n`nx graph` starts a local server (default `http://127.0.0.1:4211`). Before the fix, its request handler set a wi","public_affected_ranges":[">= 17.0.4, < 22.7.2"]},{"certainty":"source_listed","source_ids":["sr-54a435052772d4da68aed5651e13e66c"],"technology":"nx","known_exclusions":[],"conditions_summary":"## Summary\n\nThe local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the `/help` endpoint, which runs a target's configured help command. The practical impact is typically **cross-origin information disclosure**, but can be arbitrary command injection in rare cases.\n\n## Severity\n\n\nExploitation requires the developer to be running `nx graph` and to visit an attacker page. Any execution beyond benign help commands also requires a malicious target to already be present in the workspace (see Details).\n\n## Affected & Patched Versions\n\nPackage: `nx` (npm).\n\n- **Affected:** `>= 17.0.4, = 23.0.0-beta.0, < 23.0.0-beta.2`\n- **Patched:** `22.7.2`+ (backport) and `23.0.0` (first in `23.0.0-beta.2`)\n\nThe wildcard CORS header was introduced in `17.0.4`; the `/help` execution endpoint in `19.4.0`. **The `21.x` line is not patched** — `21.x` users should upgrade to `22.7.2` or later.\n\n## Details\n\n`nx graph` starts a local server (default `http://127.0.0.1:4211`). Before the fix, its request handler set a wi","public_affected_ranges":[">= 23.0.0-beta.0, < 23.0.0-beta.2"]}],"null_published_at":"2026-11-03T10:03:26.568Z","source_updated_at":"2026-07-31T16:50:25.000Z","source_disclosed_at":"2026-07-31T16:50:24.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T09:58:49.818Z"}],"next_cursor":null,"snapshot_revision":"42594"}