{"id":"CVE-2026-48027","kind":"vulnerability","aliases":["CVE-2026-48027"],"related":[],"title":"Nx Console is the user interface for Nx & Lerna","description":"Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.","summary":"A malicious version of the Nx Console extension was published and shipped embedded malicious code that fetched an obfuscated payload. The payload harvests credentials from disk and memory, so an attacker can take secrets from any machine that installed it.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-05-27T00:00:00+00:00","products":[{"name":"Nx Nx Console","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"nx console","fixed":[],"affected":"= 18.95.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","ci","developers","exploited","nx","nx-console","ransomware","vs-code"],"not_affected_if":["extension-not-installed"],"how_to_check":"Check installed Nx Console (VS Code / editor extension) versions and look for the malicious release identified in the vendor advisory; unknown which exact version string from sources.\nTreat any machine that installed the affected extension as potentially credential-exposed and review recent token/key use.","fix":"Remove the compromised Nx Console extension version and reinstall a verified clean release per vendor instructions; unknown which version is clean from sources.\nRotate credentials that were available on affected machines (cloud keys, npm/GitHub tokens, SSH keys), since they may have been harvested.","status":"open","published_at":"2026-05-27T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:03+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-23T20:34:03Z","model":"claude-haiku-5-5","output":{"fix":"Remove the compromised Nx Console extension version and reinstall a verified clean release per vendor instructions; unknown which version is clean from sources.\nRotate credentials that were available on affected machines (cloud keys, npm/GitHub tokens, SSH keys), since they may have been harvested.","summary":"A malicious version of the Nx Console extension was published and shipped embedded malicious code that fetched an obfuscated payload. The payload harvests credentials from disk and memory, so an attacker can take secrets from any machine that installed it.","category":"ai-tooling","who_cares":["nx","nx-console","vs-code","developers","ci"],"confidence":0.6,"analyst_note":"Sources are only the CISA KEV entry; find the vendor/Nx advisory for affected and fixed versions, the malicious version identifiers, and IOCs (see https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48027).","how_to_check":"Check installed Nx Console (VS Code / editor extension) versions and look for the malicious release identified in the vendor advisory; unknown which exact version string from sources.\nTreat any machine that installed the affected extension as potentially credential-exposed and review recent token/key use.\nunknown for other specific file paths or commands.","needs_analyst":true,"not_affected_if":["extension-not-installed"],"severity_if_unknown":"critical"},"cost_usd":0.000456,"input_tokens":2091,"output_tokens":494,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-48027':12A,15A '09':139C '12':97C,106C,134C '13':138C '18':114C '18.100.0':144C '18.95.0':93C '19':84C '2026':86C '30':98C '33':135C '36':141C '48':107C 'ai':22B 'ai-tool':21B 'attack':65B 'avail':112C,132C 'ci':24B 'code':34B,49B 'compromis':129C,150C 'consol':2A,30B,41B,75C,92C,147C 'console':18A,20A 'credenti':58B 'cve':10A,13A 'detect':125C 'develop':25B 'disk':60B 'embed':47B 'exploit':26B 'extens':42B 'fetch':51B 'harvest':57B 'instal':73B 'interfac':6A,79C 'later':126C 'leav':110C 'lerna':9A,82C 'machin':71B 'malici':36B,48B,88C 'marketplac':119C 'may':85C,153C 'memori':62B 'minut':115C,142C 'nx':1A,8A,16A,17A,19A,27B,29B,40B,74C,81C,91C,146C 'nx-consol':28B 'obfusc':53B 'openvsx':121C 'payload':54B,56B 'pm':99C,108C 'problem':123C 'publish':44B,95C 'ransomwar':31B 'remedi':154C 'remov':102C 'secret':68B 'ship':46B 'soon':103C 'studio':118C 'take':67B 'tool':23B 'upgrad':156C 'user':5A,78C,152C 'utc':100C,109C,136C,140C 'version':37B,89C,130C,143C,159C 'visual':117C 'vs':33B 'vs-code':32B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-05-27T00:00:00+00:00","kev":{"dateAdded":"2026-05-27","dueDate":"2026-06-10","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-48027","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48027","severity":null,"published_at":"2026-05-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-48027","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48027","severity":null,"published_at":"2026-05-27T17:16:41+00:00","modified_at":"2026-10-14T20:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}