9.6
Critical
CVE-2025-10894 Malicious code was inserted into the Nx (build system) package and several related plugins
Description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Multicluster Global Hub | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published |
References
- access.redhat.com access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2396282 bugzilla.redhat.com
- github.com github.com
- www.stepsecurity.io www.stepsecurity.io
- www.wiz.io www.wiz.io
Timeline
- Published
- Last modified
Other CVEs of Multicluster Global Hub
The 32 CVEs of Multicluster Global Hub →
CVE-2026-110744
A flaw was found in multicluster-global-hub-operator-bundle
7.2
High
CVE-2026-83550
A flaw was found in postgres-exporter
7.1
High
CVE-2026-66792
A flaw was found in the multicloud-operators-subscription component
9.9
Critical
CVE-2026-71577
A flaw was found in multicluster-global-hub
6.3
Medium