Nx EUVD-2026-91761

Requires (1) a hostile direct dependency, or a package introduced through a trusted package's packageGroup, that supplies an nx-migrations.migrations value containing '..' segments or an absolute path; (2) the victim invoking nx migrate where the normal nx@latest handoff is bypassed so the vulnerable installed Nx copy runs - triggered by NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or the fallback after a temporary-install failure. Affected range is Nx 13.10.0 up to (not including) 22.7.10, and 23.2.x before 23.2.1. Limiting factors: it is a local vector (AV:L) requiring victim action (running migrate), the handoff bypass is non-default behavior, and a malicious package must already be present; however, it fires during migration planning BEFORE the migration list is reviewed or --run-migrations is used, so it is not gated by migration approval.

This is a moderate-risk path traversal (CWE-22) with a vendor-assigned CVSS 4.0 base score of 5.8. The provided vector (AV:L/AC:L/AT:P/PR:N/UI:P) tells a nuanced story that matters more than the headline number: although PR:N marks it unauthenticated, AV:L means it is NOT a remote network attack, AT:P signals a specific attack precondition must hold, and UI:P means a victim must perform an action (running nx migrate). Exploitation is effectively a supply-chain / local scenario, not an internet-facing one. No EPSS score, KEV listing, or public POC is present in the supplied data, so the exploitation status is 'no public exploit identified at time of analysis' - this is not a mass-exploitation candidate. The realistic risk is gated heavily by the requirement that the victim bypass the normal nx@latest handoff (via NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or a temporary-install fallback) AND that a hostile dependency is already present in the tree. Technical impact is genuine where conditions hold (arbitrary file write/truncation outside the temp directory, with potential to clobber writable files even when no archive entry matches), so for CI pipelines and developer machines that use local-migration flags this warrants timely patching, but it is a contained developer-tooling risk rather than a high-urgency internet-exposed emergency. Note the vendor's VC:L assignment is debatable: the described primitive is arbitrary file write/truncation (integrity/availability), not data disclosure - verify confidentiality impact with the vendor advisory.

A developer adds or transitively pulls in a malicious npm package whose manifest sets nx-migrations.migrations to a value like '../../../../etc/profile' or an absolute path. When the developer or a CI job runs nx migrate with the local-handoff bypass active (e.g. NX_MIGRATE_USE_LOCAL set), Nx joins the escaping path onto its temp directory during migration planning and writes attacker-controlled bytes - or truncates an existing writable file - outside that directory, before any migration review. No public exploit code is identified at time of analysis.