Log in Start free

Vulnerability · Published Oct 2, 2026 · Assigned by GitHub_M

CVE-2026-104859Nx: OS command injection in the @nx/docker release pipeline

High 7.3

In plain English

A high-severity OS command injection in nx from nrwl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl configuration values are interpolated into those strings and passed to /bin/sh -c, allowing shell syntax in untrusted Nx configuration to execute during nx release version or nx release publish. A pull request or repository configuration change can therefore execute commands with the release job's privileges and expose registry credentials or cloud tokens, and dry-run publishing does not prevent the vulnerable pre-check command from executing. This issue is fixed in versions 22.7.8 and 23.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@nx/docker22.7.8GHSA-6vc5-vf29-ffr2
npm@nx/docker23.1.1GHSA-6vc5-vf29-ffr2

Affected products (as reported)

VendorProductVersions
nrwl nx >= 21.4.0, < 22.7.8>= 23.0.0, < 23.1.1

Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References