PatchTheCVECVE-2026-48027: Nx Console Embedded Malicious Code Vulnerability
CVE-2026-48027 is a critical-severity flaw (CVSS 9.8) affecting nx console, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate
Why this priority
- Critical severity
- Exploited in the wild (CISA KEV)
- Used in ransomware campaigns
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.8% (top 21%) |
| CISA exploited list | Yes, fix due 2026-06-10, used in ransomware |
| Weakness | CWE-506 |
| Published | 2026-05-27 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Published CVE record published
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-48027?
nx console: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2026-48027 being exploited?
Yes. CVE-2026-48027 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2026-48027 affect?
CVE-2026-48027 affects nx console. Severity is critical (CVSS 9.8). Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketp
How urgent is CVE-2026-48027?
Priority 97/100. Critical severity; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action