CVE-2026-48027

CVE-2026-48027 is a supply-chain compromise in which version 18.95.0 of Nx Console, the Visual Studio Code UI for the Nx and Lerna build tools, was published with embedded malicious code (CWE-506). The compromised release was live on the Visual Studio Marketplace for roughly 18 minutes (12:30-12:48 UTC) and on OpenVSX for about 36 minutes (12:33-13:09 UTC) on 19 May 2026, so developers whose clients pulled the update during those windows had the malicious extension installed. An attacker gains code execution on developer workstations and used it to steal cloud and CI credentials; the compromise has been tied to a breach of GitHub internal repositories and is associated with ransomware activity. Only users who installed Nx Console 18.95.0 are affected, and version 18.100.0 is not compromised. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 27 May 2026 with known ransomware use, and public analysis is available from StepSecurity.

What to do: Upgrade to Nx Console 18.100.0 immediately; if 18.95.0 was installed on 19 May 2026, treat local secrets as compromised and rotate GitHub tokens, cloud and CI credentials, npm tokens, and SSH keys on affected machines, and review repositories and pipelines for tampering. Follow CISA KEV/BOD 22-01 required actions and review the StepSecurity blog post for indicators of compromise.