CVE-2026-48027: Compromised Nx Console version 18.95.0

Synopsis

This is a supply-chain compromise affecting Nx Console version 18.95.0, a Visual Studio Code extension for Nx and Lerna. The malicious package was published to the Visual Studio Marketplace and OpenVSX on 19 May 2026 and was reachable over the network by any unauthenticated user who installed or auto-updated the extension during an 18-36 minute window. Successful exploitation gives an attacker full read, write, and denial-of-service capability over affected systems. No patched image rebuild is available yet because no official fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The malicious extension is distributed over the network via the Visual Studio Marketplace and OpenVSX, so an attacker's payload reaches victims through standard internet package delivery.

• AuthenticationNot required

  No account or credentials are required; any developer who fetches the extension during the exposure window receives the compromised package.

• Victim interactionNot required

  No explicit victim action beyond a normal install or auto-update is needed; the extension manager handles the fetch transparently.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the package is served; no race condition or special environment configuration is required on the attacker's side.

Blast Radius

• Reads secrets, tokens, and source files accessible to the developer's IDE process.
• Writes or modifies files on the developer's workstation, including project source code and configuration.
• Can crash or degrade the developer's local environment and any build tooling driven by Nx Console.
• Provides a foothold on the developer's machine that can be used to pivot into connected CI systems or cloud credentials stored locally.