9.6
Critique
CVE-2025-10894 Malicious code was inserted into the Nx (build system) package and several related plugins
Description
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo under user's accounts.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Multicluster Global Hub | Versions non publiées | |
| OpenShift Serverless | Versions non publiées | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2396282 bugzilla.redhat.com
- github.com github.com
- www.stepsecurity.io www.stepsecurity.io
- www.wiz.io www.wiz.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Multicluster Global Hub
Les 32 CVE de Multicluster Global Hub →
CVE-2026-110744
A flaw was found in multicluster-global-hub-operator-bundle
7.2
Élevée
CVE-2026-83550
A flaw was found in postgres-exporter
7.1
Élevée
CVE-2026-66792
A flaw was found in the multicloud-operators-subscription component
9.9
Critique
CVE-2026-71577
A flaw was found in multicluster-global-hub
6.3
Moyenne