Skip to content
Fencer Intel
critical 9.6

CVE-2025-10894 json

Nx: nx/devkit: malicious versions of nx and plugins published to npm

published last yr. modified 3mo ago also EUVD-2025-29473 , GHSA-cxm3-wv7p-598c

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository nrwl/nx. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
9.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Is CVE-2025-10894 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-10894 updated cvss 9.6

nx: nx/devkit: Malicious versions of nx and plugins published to npm

  • Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9 Red Hat Ansible Automation Platform 2 automation-gateway
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

0.56% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c referenced PoC, tagged "exploit" by a source, unverified
  • stepsecurity.io https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm nx
21.5.0 … 20.12.0 (8 versions)
 no fix listed
npm @nx/devkit
21.5.0, 20.9.0
 no fix listed
npm @nx/js
21.5.0, 20.9.0
 no fix listed
npm @nx/workspace
21.5.0, 20.9.0
 no fix listed
npm @nx/eslint
21.5.0
 no fix listed
npm @nx/node
21.5.0, 20.9.0
 no fix listed

Affected products

  • Red Hat Multicluster Global Hub
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ansible Automation Platform 2

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of nrwl/nx published their own advisory on GitHub. Reviewed sources take precedence over it.