CVE-2026-54753

The record

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.

Affected packages

Related vulnerabilities

• CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
• CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749
• CVE-2026-52877 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
• CVE-2026-48056 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
• CVE-2026-20467 In apusys, there is a possible escalation of privilege due to a missing bounds check. CWE-749
• CVE-2026-45489 Microsoft Edge (Chromium-based) Spoofing Vulnerability CWE-749
• CVE-2026-14620 webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints… CWE-749
• CVE-2026-55454 Appsmith is a platform to build admin panels, internal tools, and dashboards. CWE-749