AEGLIX vulnerability intelligence
CVE-2026-48027
CRITICAL · CVSS 9.3 · Analyzed
Published: 2026-05-27 · Updated: 2026-10-14 · Source: NVD
Vulnerability overview
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
Severity and scoring
- CVSS score
- 9.3 · CRITICAL
- CVSS version
- 4.0
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-506
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Nx · Nx Console
- Added to catalog
- 2026-05-27
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CISA remediation due date
- 2026-06-10
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:nx:nx_console:18.95.0:*:*:*:*:visual_studio_code:*:*
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://github.com/nrwl/nx-console/issues/3139
Issue Tracking
- https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w
Mitigation · Vendor Advisory
- https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise
Vendor Advisory
- https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised
Exploit · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48027
US Government Resource