AIKIDO-2026-42325

TL;DR

nx migrate extracts a target package's migrations file to a destination built by joining the package's nx-migrations.migrations manifest value onto a temporary directory, and that value is read without validation. The matching logic normalizes .. segments while the write path keeps them, so a crafted manifest value can truncate an existing file the running user can access or write attacker-controlled tarball content outside the temporary directory. The fix validates that the migrations path stays inside the temporary directory before extraction.