Nx, a monorepo solution for TypeScript and polyglot codebases, contains a Zip‑Slip style flaw in its self‑hosted remote cache extraction logic. The program does not constrain the paths of extracted files, so a malicious or MITM remote cache server can supply a crafted tar archive whose entries write outside the cache directory. This allows an attacker to overwrite or create files on the host system, which can be escalated to remote code execution. The weakness corresponds to CWE‑22 and CWE‑59.

The affected product is Nrwl Nx. Versions from 20.8.0 up to and including 22.7.7, as well as the 23.0.2 release, are vulnerable when a workspace is configured to use a self‑hosted remote cache. Default local cache and Nx Cloud are not affected.

The CVSS score of 8.7 indicates high severity. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog suggests no publicly known exploitation has been observed. Nevertheless, the vulnerability is exploitable via a compromised or on‑path remote cache server, which can provide a malicious archive. The attack vector is inbound, relying on the host's acceptance of a remote cache response. The high consequence and potential for remote code execution make immediate remediation prudent, while the exploitation probability remains uncertain due to missing EPSS data.