Nx: Path traversal in nx migrate package-migrations extraction

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104853 · Microsoft / collected KEV context

EUVD-2026-91761

GHSA-hrvq-x7jp-36xv

cve-program · CVE-2026-104853

• https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv
• https://github.com/nrwl/nx/pull/36887
• https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f
• https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90
• https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f
• https://github.com/nrwl/nx/releases/tag/22.7.10
• https://github.com/nrwl/nx/releases/tag/23.2.1

euvd · EUVD-2026-91761

• https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv
• https://github.com/nrwl/nx/pull/36887
• https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f
• https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90
• https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f
• https://github.com/nrwl/nx/releases/tag/22.7.10
• https://github.com/nrwl/nx/releases/tag/23.2.1

nvd · CVE-2026-104853

• https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f
• https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90
• https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f
• https://github.com/nrwl/nx/pull/36887
• https://github.com/nrwl/nx/releases/tag/22.7.10
• https://github.com/nrwl/nx/releases/tag/23.2.1
• https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv

osv · GHSA-hrvq-x7jp-36xv

• https://github.com/nrwl/nx/security/advisories/GHSA-hrvq-x7jp-36xv
• https://nvd.nist.gov/vuln/detail/CVE-2026-104853
• https://github.com/nrwl/nx/pull/36887
• https://github.com/nrwl/nx/commit/38cd82a0c05e8212e538bdb87ccb198d6504e58f
• https://github.com/nrwl/nx/commit/95474ab457e8e1dbdbefad29040c166105a8fb90
• https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f
• https://github.com/nrwl/nx
• https://github.com/nrwl/nx/releases/tag/22.7.10
• https://github.com/nrwl/nx/releases/tag/23.2.1

No related operational record is retained in the current change model.