Is CVE-2026-54753 actively exploited?

No active exploitation of CVE-2026-54753 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-54753 be exploited remotely?

Yes. CVE-2026-54753 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-54753?

CVE-2026-54753 has a CVSS score of 5.9 (MEDIUM).

HOME VULNERABILITIESCVE-2026-54753

MEDIUM

CVE-2026-54753

CWE-749Published: June 26, 2026· Updated: Jun 26, 2026

5.9

CVSS v3.1

EPSS:0.81%probability of exploitation in 30 daysPercentile:52.4th

Official Description

Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. This vulnerability is fixed in 22.7.2 and 23.0.0-beta.2.

NVD Source

Technical Analysis

CVE-2026-54753 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.9.