---
id: "CVE-2026-48027"
kind: "vulnerability"
aliases: ["CVE-2026-48027"]
title: "Nx Console is the user interface for Nx & Lerna"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "Nx Nx Console", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "nx console", "fixed": [], "affected": "= 18.95.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ai-tooling", "ci", "developers", "exploited", "nx", "nx-console", "ransomware", "vs-code"]
not_affected_if: ["extension-not-installed"]
published_at: "2026-05-27T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48027", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48027", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Nx Console is the user interface for Nx & Lerna

A malicious version of the Nx Console extension was published and shipped embedded malicious code that fetched an obfuscated payload. The payload harvests credentials from disk and memory, so an attacker can take secrets from any machine that installed it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Nx Nx Console affected ? fixed ?
- vendor:nx console affected = 18.95.0 fixed ?

## How to check

Check installed Nx Console (VS Code / editor extension) versions and look for the malicious release identified in the vendor advisory; unknown which exact version string from sources.
Treat any machine that installed the affected extension as potentially credential-exposed and review recent token/key use.

## Fix

Remove the compromised Nx Console extension version and reinstall a verified clean release per vendor instructions; unknown which version is clean from sources.
Rotate credentials that were available on affected machines (cloud keys, npm/GitHub tokens, SSH keys), since they may have been harvested.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48027
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48027

## From the sources

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_