Path traversal and link following vulnerabilities in the Nx monorepo toolset could allow remote attackers to gain unauthorized access to sensitive files on the host system.

This vulnerability involves path traversal (CWE-22) and improper link resolution (CWE-59), allowing a user to access files outside the restricted directory. This typically requires user interaction to trigger the malicious path handling.

Successful exploitation allows an attacker to read or modify arbitrary files on the system, potentially leading to credential theft, configuration tampering, or remote code execution. Given the CVSS score of 8.7, this is a significant security risk for build environments and developer workstations.

Immediate Action: Update the Nx package to version 22.7.7 or 23.0.2 to include the necessary path validation fixes.

Proactive Monitoring: Audit file access logs for unexpected read or write operations originating from the Nx build process or associated CLI tools.

Compensating Controls: Run builds in isolated environments, such as containers, with limited filesystem access and non-privileged service accounts.

Public Exploit Available: No (exploit_available: false)

Organizations using Nx for monorepo management must apply the security updates immediately. Given the potential for file system manipulation, ensuring that developers and build pipelines are running the patched versions is critical to maintaining the integrity of the development lifecycle.