{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-48027",
  "revision": 1,
  "title": "Nx Console — malicious extension version live for 18 minutes",
  "summary": "A malicious build of the Nx Console editor extension, version 18.95.0, was published to the Visual Studio Marketplace and OpenVSX on 19 May 2026 and pulled within the hour. Anyone who installed it in that window ran credential-stealing code.",
  "source_type": "cve",
  "severity": "critical",
  "cvss": {
    "score": 9.8,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "version": "3.1"
  },
  "epss": 0.0185,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "attack_complexity": "low",
    "kev_added": "2026-05-27",
    "prerequisites": "The victim installed or auto-updated Nx Console during the short window the malicious version was live."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "Nx Console 18.100.0"
    ]
  },
  "kill_chain": "initial_access",
  "recommended_action": "Upgrade Nx Console to 18.100.0 now; on any machine that ran 18.95.0, rotate every credential the editor could read and work through the published indicators.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "references",
        "published_at"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-48027",
      "retrieved_at": "2026-09-24T06:28:59.498Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-09-24T06:28:59.498Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-48027",
      "retrieved_at": "2026-09-24T06:28:59.498Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-48027",
      "retrieved_at": "2026-09-24T06:28:59.498Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48027",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "vendor_advisory",
      "url": "https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w"
    },
    {
      "type": "vendor_advisory",
      "url": "https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise"
    },
    {
      "type": "exploit",
      "url": "https://www.stepsecurity.io/blog/nx-console-vs-code-extension-compromised"
    }
  ],
  "published_at": "2026-05-27T17:16:41.787Z",
  "issued_at": "2026-09-24T06:28:59.498Z",
  "tags": [
    "nx",
    "supply-chain",
    "editor-extension",
    "credential-theft",
    "kev"
  ]
}