{"id":"CVE-2026-104853","summary":"Nx: Path traversal in nx migrate package-migrations extraction","details":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.","aliases":["GHSA-hrvq-x7jp-36xv"],"modified":"2026-10-04T02:46:40.266653873Z","published":"2026-10-02T16:52:07.624Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104853.json"},"references":[{"type":"WEB","url":"https://github.com/nrwl/nx/releases/tag/22.7.10"},{"type":"WEB","url":"https://github.com/nrwl/nx/releases/tag/23.2.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104853.json"},{"type":"ADVISORY","url":"https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104853"},{"type":"FIX","url":"https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f"},{"type":"FIX","url":"https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90"},{"type":"FIX","url":"https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f"},{"type":"FIX","url":"https://github.com/nrwl/nx/pull/36887"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nrwl/nx","events":[{"introduced":"35a5f826dc5d6ae000000f38f588fdbec333a283"},{"introduced":"d9d260c1eeea2a160ba39a704fd4821fbc9e0e22"},{"fixed":"38cd82a0c05e8212e538bdb87ccb198d6504e58f"},{"fixed":"816ceee2bb83529b2c8f85b2455977ba874ec727"},{"fixed":"95474ab457e8e1dbdbefad29040c166105a8fb90"},{"fixed":"de37c5ebd1852fac700d70726326236ac398af3f"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"13.10.0"},{"fixed":"22.7.10"},{"introduced":"23.0.0"},{"fixed":"23.2.1"}]}}],"versions":["23.2.0","22.7.9","23.2.0-rc.2","23.2.0-rc.1","23.2.0-rc.0","22.7.8","23.2.0-beta.12","23.2.0-beta.11","23.2.0-beta.10","23.2.0-beta.9","23.2.0-beta.8","23.2.0-beta.7","23.2.0-beta.6","23.2.0-beta.5","23.2.0-beta.4","23.2.0-beta.3","22.7.7","23.2.0-beta.2","23.2.0-beta.1","23.1.0","23.2.0-beta.0","23.1.0-rc.3","23.1.0-rc.2","22.7.6","23.1.0-rc.1","23.1.0-rc.0","23.1.0-beta.7","23.1.0-beta.6","22.7.0-beta.0","23.1.0-beta.5","23.1.0-beta.4","23.1.0-beta.3","23.1.0-beta.2","23.0.0","23.1.0-beta.1","23.1.0-beta.0","22.7.5","22.7.4","22.7.3","22.7.2","22.7.1","22.7.0","22.7.0-rc.2","22.7.0-rc.1","22.7.0-rc.0","22.7.0-beta.17","22.7.0-beta.16","22.7.0-beta.15","22.7.0-beta.14","22.7.0-beta.13","22.7.0-beta.12","22.7.0-beta.11","22.7.0-beta.10","22.7.0-beta.9","22.7.0-beta.8","22.7.0-beta.7","22.7.0-beta.6","22.7.0-beta.5","22.7.0-beta.4","22.7.0-beta.3","22.7.0-beta.2","22.7.0-beta.1","22.6.0","22.6.0-rc.2","22.6.0-rc.1","22.6.0-rc.0","22.6.0-beta.14","22.6.0-beta.13","22.6.0-beta.12","22.6.0-beta.11","22.6.0-beta.10","22.6.0-beta.9","22.6.0-beta.8","22.6.0-beta.7","22.6.0-beta.6","22.6.0-beta.5","22.6.0-beta.4","22.6.0-beta.3","22.6.0-beta.2","22.6.0-beta.1","22.6.0-beta.0","22.5.0","22.5.0-beta.5","22.5.0-beta.4","22.5.0-beta.3","22.5.0-beta.2","22.5.0-beta.1","22.4.1","22.5.0-beta.0","22.4.0","22.4.0-beta.5","22.4.0-beta.4","22.4.0-beta.3","22.4.0-beta.2","22.4.0-beta.1","22.4.0-beta.0","22.3.0","22.3.0-beta.3","22.3.0-beta.2","22.3.0-beta.1","22.2.3","22.3.0-beta.0","22.2.2","22.2.1","22.2.0","22.2.0-beta.4","22.2.0-beta.3","22.2.0-beta.2","22.2.0-beta.1","22.2.0-beta.0","22.1.1","22.1.0","22.1.0-rc.5","22.1.0-rc.4","22.1.0-rc.3","22.1.0-rc.2","22.1.0-rc.1","22.1.0-rc.0","22.1.0-beta.8","22.1.0-beta.7","22.1.0-beta.6","22.1.0-beta.5","22.1.0-beta.4","22.1.0-beta.3","22.1.0-beta.2","22.1.0-beta.1","22.0.1","22.1.0-beta.0","22.0.0","22.0.0-rc.0","22.0.0-beta.9","22.0.0-beta.8","22.0.0-beta.7","22.0.0-beta.6","22.0.0-beta.5","22.0.0-beta.4","22.0.0-beta.3","22.0.0-beta.2","22.0.0-beta.1","22.0.0-beta.0","21.6.1","21.6.1-rc.0","21.6.1-beta.4","21.6.1-beta.3","21.6.1-beta.2","21.6.1-beta.1","21.5.1","21.6.1-beta.0","21.5.1-beta.5","21.5.1-beta.4","21.5.1-beta.3","21.5.0-beta.2","21.4.0","21.5.0-beta.1","21.5.0-beta.0","21.4.0-beta.12","21.4.0-beta.11","21.4.0-beta.10","21.4.0-beta.9","21.4.0-beta.8","21.4.0-beta.7","21.4.0-beta.6","21.4.0-beta.5","21.4.0-beta.4","21.4.0-beta.3","21.4.0-beta.2","21.4.0-beta.1","21.3.0","21.4.0-beta.0","21.3.0-rc.0","21.3.0-beta.7","21.3.0-beta.6","21.3.0-beta.5","21.3.0-beta.4","21.3.0-beta.3","21.3.0-beta.2","21.3.0-beta.1","21.2.1","21.3.0-beta.0","21.2.0","21.2.0-beta.5","21.2.0-beta.4","21.2.0-beta.3","21.2.0-beta.2","21.2.0-beta.1","21.1.0","21.1.0-beta.2","21.0.3","21.1.0-beta.1","21.1.0-beta.0","21.0.4-beta.0","21.0.2","21.0.1","21.0.0","21.0.0-rc.4","21.0.0-rc.3","21.0.0-rc.2","21.0.0-rc.1","21.0.0-rc.0","21.0.0-beta.12","21.0.0-beta.11","21.0.0-beta.10","21.0.0-beta.9","21.0.0-beta.8","20.8.0","21.0.0-beta.7","21.0.0-beta.6","21.0.0-beta.5","21.0.0-beta.3","21.0.0-beta.4","20.8.0-rc.0","20.8.0-beta.2","20.8.0-beta.1","20.8.0-beta.0","20.7.0","20.7.0-beta.3","20.7.0-beta.2","20.7.0-beta.1","20.6.0-beta.1","20.6.0","20.7.0-beta.0","20.5.0","20.6.0-beta.0","20.5.0-rc.4","20.5.0-rc.3","20.5.0-rc.2","20.5.0-rc.1","20.5.0-rc.0","20.5.0-beta.5","20.5.0-beta.4","20.5.0-beta.3","20.5.0-beta.2","20.4.0-rc.0","20.4.0","20.5.0-beta.1","20.5.0-beta.0","20.4.0-beta.2","20.4.0-beta.1","20.4.0-beta.0","20.3.0","20.3.0-rc.0","20.3.0-beta.1","20.3.0-beta.0","20.2.0","20.2.0-rc.0","20.2.0-beta.7","20.2.0-beta.6","20.2.0-beta.5","20.2.0-beta.4","20.2.0-beta.3","20.2.0-beta.2","20.2.0-beta.1","20.1.0","20.2.0-beta.0","20.1.0-beta.5","20.1.0-beta.4","20.1.0-beta.3","20.1.0-beta.2","20.1.0-beta.1","20.1.0-beta.0","20.0.0","20.0.0-rc.0","20.0.0-beta.8","20.0.0-beta.7","20.0.0-beta.6","20.0.0-beta.5","20.0.0-beta.4","20.0.0-beta.3","19.8.0","20.0.0-beta.2","20.0.0-beta.1","20.0.0-beta.0","19.8.0-beta.3","19.8.0-beta.2","19.8.0-beta.1","19.8.0-beta.0","19.7.2","19.7.1","19.7.0","19.7.0-beta.6","19.7.0-beta.5","19.7.0-beta.4","19.7.0-beta.3","19.7.0-beta.2","19.7.0-beta.1","19.7.0-beta.0","19.6.0","19.6.0-rc.0","19.6.0-beta.6","19.6.0-beta.5","19.6.0-beta.4","19.6.0-beta.3","19.6.0-beta.2","19.6.0-beta.1","19.6.0-beta.0","19.5.1","19.5.0","19.5.0-beta.5","19.5.0-beta.4","19.5.0-beta.3","19.5.0-beta.2","19.5.0-beta.0","19.4.0","19.4.0-rc.0","19.4.0-beta.2","19.3.0-beta.2","19.4.0-beta.1","19.4.0-beta.0","19.3.0-beta.1","19.2.3","19.2.2","19.2.1","19.3.0-beta.0","19.2.0","19.2.0-rc.1","19.2.0-rc.0","19.2.0-beta.7","19.2.0-beta.6","19.2.0-beta.5","19.2.0-beta.4","19.2.0-beta.3","19.2.0-beta.2","16.9.1","19.2.0-beta.1","19.2.0-beta.0","19.1.0","19.1.0-beta.5","19.1.0-beta.4","19.1.0-beta.3","19.1.0-beta.2","19.1.0-beta.1","19.1.0-beta.0","19.0.0-rc.2","19.0.0","19.0.0-rc.1","19.0.0-rc.0","19.0.0-beta.11","19.0.0-beta.10","19.0.0-beta.9","19.0.0-beta.8","19.0.0-beta.6","19.0.0-beta.5","19.0.0-beta.4","19.0.0-beta.3","19.0.0-beta.2","19.0.0-beta.1","19.0.0-beta.0","18.3.1","18.3.0","18.3.0-beta.3","18.3.0-beta.2","18.3.0-beta.1","17.0.5","18.3.0-beta.0","17.0.4","18.2.1","18.2.0","18.2.0-beta.3","18.2.0-beta.2","18.2.0-beta.1","18.1.2","18.2.0-beta.0","18.1.1","18.1.0-beta.10","18.1.0-beta.9","18.1.0-beta.8","18.1.0-beta.7","18.1.0-beta.6","18.1.0-beta.5","18.1.0-beta.4","18.1.0-beta.3","18.1.0-beta.2","18.1.0-beta.1","18.1.0-beta.0","18.0.1","18.0.0","18.0.0-beta.3","18.0.0-beta.2","18.0.0-beta.1","17.3.0","18.0.0-beta.0","17.3.0-rc.1","17.3.0-rc.0","17.3.0-beta.8","17.3.0-beta.7","17.3.0-beta.6","17.3.0-beta.5","17.3.0-beta.4","17.3.0-beta.3","17.3.0-beta.2","17.3.0-beta.1","17.2.0","17.2.0-rc.0","17.2.0-beta.15","17.2.0-beta.14","17.2.0-beta.13","17.2.0-beta.12","17.2.0-beta.11","17.2.0-beta.10","17.2.0-beta.9","17.2.0-beta.8","17.2.0-beta.7","17.2.0-beta.2","17.2.0-beta.1","17.2.0-beta.0","17.1.1","17.1.0","17.1.0-rc.0","17.1.0-beta.5","17.1.0-beta.4","17.1.0-beta.3","17.1.0-beta.2","17.0.2","17.1.0-beta.0","17.0.1","17.0.0","17.0.0-rc.3","17.0.0-rc.2","17.0.0-rc.1","17.0.0-rc.0","17.0.0-beta.8","17.0.0-beta.7","17.0.0-beta.6","17.0.0-beta.5","17.0.0-beta.4","17.0.0-beta.2","17.0.0-beta.1","17.0.0-beta.0","16.10.0-beta.2","16.10.0","16.10.0-beta.1","16.10.0-beta.0","16.9.0","16.9.0-rc.1","16.9.0-rc.0","16.9.0-beta.4","16.9.0-beta.3","16.9.0-beta.2","16.9.0-beta.1","16.9.0-beta.0","16.8.0","16.8.0-rc.0","16.8.0-beta.7","16.8.0-beta.6","16.8.0-beta.5","16.8.0-beta.4","16.8.0-beta.3","16.8.0-beta.2","16.8.0-beta.1","16.8.0-beta.0","16.7.0","16.7.0-rc.1","16.7.0-rc.0","16.7.0-beta.6","16.7.0-beta.5","16.7.0-beta.4","16.7.0-beta.3","16.7.0-beta.2","16.7.0-beta.1","16.7.0-beta.0","16.6.0","16.6.0-beta.8","16.6.0-beta.7","16.6.0-beta.6","16.6.0-beta.5","16.6.0-beta.4","16.6.0-beta.3","16.6.0-beta.2","16.6.0-beta.1","16.6.0-beta.0","16.5.0","16.5.0-beta.3","16.5.0-beta.2","16.5.0-beta.1","16.5.0-beta.0","16.4.0","16.4.0-beta.16","16.4.0-beta.15","16.4.0-beta.14","16.4.0-beta.11","16.4.0-beta.10","16.4.0-beta.9","16.4.0-beta.8","16.4.0-beta.7","16.4.0-beta.6","16.4.0-beta.5","16.4.0-beta.4","16.4.0-beta.3","16.4.0-beta.2","16.4.0-beta.1","16.4.0-beta.0","16.3.1","16.3.0","16.3.0-beta.15","16.3.0-beta.14","16.3.0-beta.13","16.3.0-beta.12","16.3.0-beta.8","16.3.0-beta.7","16.3.0-beta.6","16.3.0-beta.5","16.2.1","16.3.0-beta.4","16.3.0-beta.1","16.3.0-beta.0","16.2.0","16.2.0-beta.3","16.2.0-beta.2","16.2.0-beta.1","16.2.0-beta.0","16.1.0","16.1.0-rc.1","16.1.0-rc.0","16.1.0-beta.0","16.0.0","16.0.0-rc.1","16.0.0-rc.0","16.0.0-beta.8","16.0.0-beta.7","16.0.0-beta.6","16.0.0-beta.5","16.0.0-beta.4","16.0.0-beta.3","16.0.0-beta.2","16.0.0-beta.1","16.0.0-beta.0","15.9.2","15.9.1","15.9.0","15.9.0-rc.2","15.9.0-rc.1","15.9.0-rc.0","15.9.0-beta.11","15.9.0-beta.10","15.9.0-beta.9","15.9.0-beta.8","15.9.0-beta.7","15.9.0-beta.6","15.9.0-beta.5","15.9.0-beta.4","15.9.0-beta.3","15.9.0-beta.2","15.9.0-beta.1","14.9.0-beta.1","15.9.0-beta.0","15.8.1","15.8.0","15.8.0-beta.8","15.8.0-beta.7","15.8.0-beta.6","15.8.0-beta.5","15.8.0-beta.4","15.8.0-beta.3","15.8.0-beta.2","15.8.0-beta.1","15.8.0-beta.0","15.7.0","15.7.0-beta.6","15.7.0-beta.5","15.7.0-beta.4","15.7.0-beta.3","15.7.0-beta.2","15.7.0-beta.1","15.7.0-beta.0","15.6.0","15.5.1","15.5.0","15.4.8","15.4.7","15.4.6","15.4.5","15.4.4","15.4.3","15.4.2","15.4.1","15.4.0","15.3.3","15.3.2","15.3.1","15.3.0","15.2.0","15.1.0","15.0.7","15.0.5","15.0.4","15.0.3","15.0.2","15.0.1","15.0.0","14.8.0","14.7.18","14.7.17","14.7.16","14.7.15","14.7.14","14.7.13","14.7.12","14.7.11","14.7.10","14.7.9","14.7.8","14.7.7","14.7.6","14.7.5","14.7.4","14.7.3","14.7.2","14.7.1","14.7.0","14.6.5","14.6.4","14.6.3","14.6.2","14.6.1","14.6.0","14.5.7","14.5.6","14.5.5","14.5.4","14.5.3","14.5.2","14.5.1","14.5.0","14.4.2","14.4.1","14.4.0","14.1.9","14.3.6","14.3.5","14.3.4","14.3.3","14.3.2","14.3.1","14.3.0","14.2.4","14.2.2","14.2.1","14.1.8","14.1.7","14.1.6","14.1.5","14.1.4","14.1.3","14.1.2","14.1.1","14.1.0","14.0.3","14.0.2","14.0.1","14.0.0","13.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104853.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}]}