Log in Start free

Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-119282Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle

High 7.3

In plain English

A high-severity OS command injection in nx from nrwl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.3High
Exploit odds (30 days)0.1%top 96.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@nx/gradle22.7.9GHSA-qm8w-vx34-5j9j
npm@nx/gradle23.1.2GHSA-qm8w-vx34-5j9j
npm@nx/maven22.7.9GHSA-qm8w-vx34-5j9j
npm@nx/maven23.1.2GHSA-qm8w-vx34-5j9j

Affected products (as reported)

VendorProductVersions
nrwl nx >= 21.0.0, < 22.7.9>= 23.0.0, < 23.1.2
@nx maven >= 21.0.0, < 22.7.9>= 23.0.0, < 23.1.2
@nx gradle >= 21.0.0, < 22.7.9>= 23.0.0, < 23.1.2

Weakness: CWE-78, CWE-88 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References