CVE-2026-71476 in Nrwl
Summary
by MITRE • 08/07/2026
Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx, which can be escalated to remote code execution. Nx's default local cache and Nx Cloud are not affected; only workspaces configured to use a self-hosted remote cache are affected. This issue is fixed in versions 22.7.7 and 23.0.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Nx represents a critical path traversal flaw that affects specific versions of the monorepo management tool, specifically those between 20.8.0 and 22.7.7, as well as version 23.0.2. This issue stems from improper handling of cache artifact extraction processes when utilizing self-hosted HTTP remote caches, creating a significant security risk for affected organizations. The flaw manifests when Nx downloads cache artifacts from remote servers and extracts them without validating or constraining the destination paths, allowing malicious actors to manipulate the extraction process through specially crafted tar archives.
The technical implementation of this vulnerability exploits the lack of proper path validation during archive extraction operations, which aligns with common CWE classifications such as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (Path Traversal). When a malicious remote cache server returns an archive containing entries with absolute paths or directory traversal sequences like ../, the extraction process can write files outside the intended cache directory. This behavior creates an arbitrary file writing condition that enables attackers to place malicious code in critical system locations, potentially leading to privilege escalation and full system compromise.
Operational impact of this vulnerability extends beyond simple data corruption, as it provides a potential pathway for remote code execution within affected environments. Attackers leveraging this vulnerability could place malicious binaries or scripts in system directories, modify configuration files, or inject backdoors into the build infrastructure. The attack vector requires either network-level compromise through man-in-the-middle positioning or access to a compromised remote cache server, but once exploited, the consequences can be severe for organizations relying on Nx for their software development workflows. This vulnerability particularly affects CI/CD environments where Nx is used for build caching, as these systems often run with elevated privileges and may contain sensitive credentials or proprietary code.
Mitigation strategies should prioritize immediate version upgrades to 22.7.7 or 23.0.2, which include fixes addressing the path traversal issue in cache extraction logic. Organizations should also implement network security controls such as certificate pinning for remote cache servers, network segmentation to isolate build environments, and monitoring for unusual file creation patterns in cache directories. The fix implemented by Nx developers likely involves adding proper path validation checks during archive extraction, ensuring that all extracted paths remain within the designated cache directory boundaries, thus preventing directory traversal attacks. Additional defensive measures include configuring secure communication protocols, implementing access controls for remote cache servers, and conducting regular security audits of build infrastructure to identify potential compromise vectors. This vulnerability highlights the importance of validating external inputs in build and deployment systems, particularly when handling automated artifact management processes that may execute with elevated privileges.