CVE-2025-108949.6CriticalCWE-506

CVE-2025-10894: Nx: nx/devkit: malicious versions of nx and plugins published to npm

Red Hat · Multicluster Global Hub

Affected: Red Hat Multicluster Global Hub · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.6%probability of exploitation in the next 30 days

47th percentile

050100

Higher than 47% of scored CVEs

9.6CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.

Affected products12

From the CVE record. A product or version that is not listed is unknown, not unaffected.

nx20.12.0; 21.8.0; 21.7.0; 20.11.0; 21.6.0; 20.10.0 and 2 more
nx/devkit20.9.0; 21.5.0
nx/enterprise-cloud3.2.0
nx/eslint21.5.0
nx/js20.9.0; 21.5.0
nx/key3.2.0
nx/node20.9.0; 21.5.0
nx/workspace20.9.0; 21.5.0
Red Hat · Multicluster Global HubVersions not stated
Red Hat · OpenShift ServerlessVersions not stated
Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Embedded Malicious Code · Supply Chain and Malicious Code
Vendor: Red Hat
Published: September 2025
Band: Unlikely (under 1%), September 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-10894 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.