Nx Console Embedded Malicious Code Vulnerability
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.
Quick answer
Nx Console should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- 18.95.0
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
Remove the affected Nx Console extension and install the fixed release from the official marketplace. Because IDE extensions can access repositories and developer credentials, remediation should include endpoint review and credential rotation.
- Inventory developer machines, build workstations, and remote dev containers with Nx Console installed.
- Uninstall the affected extension version and install the fixed release from the official Visual Studio Code or JetBrains marketplace.
- Clear IDE extension caches and remove manually installed VSIX or plugin files from affected machines.
- Rotate GitHub, GitLab, npm, cloud, SSH, package registry, and CI tokens available to affected developer environments.
- Review repositories for unexpected commits, dependency changes, generated files, or configuration changes made during the exposure window.
- Inspect endpoint telemetry for suspicious child processes, shell commands, network calls, or secret file access from the IDE.
- Enforce managed extension allow-lists and block unapproved extension versions through device management.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm the installed Nx Console version is the fixed release on all managed developer devices.
- Validate old extension packages and caches are removed from local extension directories.
- Review source control and CI audit logs for suspicious activity tied to affected users or workstations.
- Run normal Nx workspace tasks after reinstalling to confirm developer workflows still work.
- Run a Fixnx scan after redeploying any site rebuilt from cleaned developer and CI environments.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-48027?
Nx Console versions listed as affected should be reviewed: 18.95.0.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
Why can this risk appear in multiple categories?
A vulnerability can belong to more than one platform or ecosystem. Fixnx keeps one canonical risk page while also listing it in every relevant category.