Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
## Summary The Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache. ## Affected Packages > [!IMPORTANT] > **Nx's default local cache and Nx Cloud are NOT affected.** The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, `@nx/s3-cache`, etc.) are affected. Two self-hosted cache surfaces are affected: 1. **The built-in HTTP remote cache** (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, in `nx`) — **fixed** in the patched release. 2. **The self-hosted cache packages** — `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) — the same flaw in their own extractor. **Deprecated** (CVE-2025-36852) and not patched; migrate off (see Remediation). The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched `nx` release. ## Remediation **Upgrade to Nx `22.7.7` or `23.0.2` (or later).** The patched extractor is a drop-in — no configuration change is required. ### If you use the S3, GCS, Azure, or shared-filesystem cache packages `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, and `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) are separately versioned packages and are **already deprecated** (see CVE-2025-36852). Upgrading `nx` hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to **migrate off** — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages ## Details When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with `tar`'s **unguarded** `Entry::unpack()`, which performs no containment check: ```rust // vulnerable let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled fs::create_dir_all(path_on_disk.parent()…)?; entry.unpack(&path_on_disk)?; ``` In addition, restore now copies **only** the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking. ## References - Fix: https://github.com/nrwl/nx/pull/36116 (merged) - TLS-verification warning follow-up: https://github.com/nrwl/nx/pull/36132 (merged) - Vulnerable extractor introduced in Nx 20.8.0: https://github.com/nrwl/nx/pull/30593 ## Credits - **Lidor B.**, Novee Security — Reporter - **Assaf Levkovich**, Novee Security — Reporter
## Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (`("memories", "alice")` becomes `memories.alice`) and scoped reads by matching that string with `LIKE '<path>%'`. Because `LIKE` has no notion of the `.` separator, a scoped `search` or `list_namespaces` also matched sibling namespaces whose flattened form shares leading characters. Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient. We have no evidence of this behavior being exploited in the wild. ## Affected users / systems You may be affected if you: - use `PostgresStore`/`AsyncPostgresStore` or `SqliteStore`/`AsyncSqliteStore`, and - rely on the namespace to separate data between users or tenants, and - have namespace labels where one is a prefix of another (`1` and `12`, `alice` and `alice2`), or labels containing `_` or `%` Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no `_` or `%`, are not affected — no such label can be a prefix of another. `InMemoryStore` compares namespaces element-wise and is not affected. Three distinct cases were possible: - **Sibling namespaces.** A read scoped to `("foo",)` also returned items under `("foobar",)` and `("foo2",)`. - **Unescaped pattern metacharacters.** `_` and `%` are legal namespace labels — only `.` is rejected — but were interpolated into the match pattern unescaped, so `("user_1",)` also matched `("userX1",)`. - **Suffix conditions.** `list_namespaces(suffix=("alice",))` also matched the sibling leaf `users.malice`. This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value *was itself* a `LIKE` pattern whose metacharacters were not neutralized. ## Impact - Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary. - No integrity or availability impact. `get`, `put`, and `delete` compare namespaces with `=` and were never affected; the issue is limited to read paths. ## Patches / mitigation Prefix scoping now matches the namespace exactly or requires the `.` separator before any remainder, pattern metacharacters in labels are escaped, and `list_namespaces` uses segment-aware matching for both prefix and suffix conditions. On SQLite, the descendant match moved from `LIKE` to `GLOB`. `LIKE` is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while `get`/`put`/`delete` treated them as distinct. Search now agrees with them. Upgrade to `langgraph-checkpoint-postgres` 3.1.1 or `langgraph-checkpoint-sqlite` 3.1.1. ## Compatibility `*` in a `list_namespaces` match path now spans exactly one namespace segment. This restores the documented behavior — `NamespacePath` documents `("cache", "*", "v1")` as "any cache category with v1 version" — and matches `InMemoryStore`. Multi-segment matching was an artifact of translating `*` into a SQL `%` wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it. Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed: ```python list_namespaces(prefix=["uid"], suffix=["alice"]) ``` Applications whose namespace labels cannot be prefixes of one another see no behavioral change. ## Operational guidance - Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another. - Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone. ## LangSmith / hosted deployments note Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to `LANGGRAPH_STORE_BACKEND=python`, which uses `AsyncPostgresStore` from `checkpoint-postgres`. Deployments configured with `LANGGRAPH_STORE_BACKEND=grpc` use a separate implementation that received an equivalent fix.