CVE-2026-48027

Published May 27, 2026

Last updated 2 days ago

Nx Console

Lerna

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48027 identifies a supply-chain compromise involving a malicious version of the Nx Console Visual Studio Code extension, specifically version 18.95.0. This compromised extension was published to the Visual Studio Marketplace and Open VSX on May 18, 2026, after an attacker gained unauthorized access to a legitimate Nx developer's GitHub credentials, likely through a broader supply-chain attack affecting TanStack npm packages. The malicious Nx Console extension contained an obfuscated payload designed to harvest a wide array of sensitive credentials from affected developer machines. These included GitHub tokens, npm authentication tokens, AWS credentials, Vault tokens, Kubernetes and AWS IAM authentication details, 1Password CLI session data, SSH private keys, and Google Cloud and Docker credentials. The incident led to the exfiltration of approximately 3,800 of GitHub's internal repositories and impacted other organizations such as OpenAI, Grafana Labs, and Mistral AI.

Description: Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
Source: security-advisories@github.com
NVD status: Analyzed
Products: nx_console

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Nx Console Embedded Malicious Code Vulnerability
Exploit added on: May 27, 2026
Exploit action due: Jun 10, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-506

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nx:nx_console:18.95.0:*:*:*:*:visual_studio_code:*:*",
            "matchCriteriaId": "A748F70F-02F7-4793-89AE-7666A2D213F1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.