CVE-2026-104853 Nx: Path traversal in nx migrate package-migrations extraction
Attackers can write arbitrary files outside the temporary directory during Nx migration planning, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-104853?
CVE-2026-104853 is a medium-severity path traversal vulnerability in nrwl nx, published on 2 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.
Which versions are affected by CVE-2026-104853?
4 open source packages ship an affected version, including nx.
| Package | Affected | Fixed in |
|---|---|---|
nx npm | From 13.10.0 | 22.7.10 |
nx npm | From 13.10.0 | 22.7.10 |
nx npm | From 23.0.0 | 23.2.1 |
nx npm | From 23.0.0 | 23.2.1 |
How do I fix CVE-2026-104853?
Upgrade nx to a fixed version for your release line: 22.7.10 or 23.2.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104853 being exploited?
There is no known exploitation of CVE-2026-104853 in the wild and no public exploit code.
Sources
Also known as GHSA-hrvq-x7jp-36xv.