Read the docs
TI-2026-82771 Aliases CVE-2026-119282GHSA-qm8w-vx34-5j9j

OS command injection in Nx @nx/maven and @nx/gradle via nx.json

Priority LOW 33CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

The nx package and its @nx/maven and @nx/gradle plugins are affected, with nx and @nx/gradle from 21.0.0 before 22.7.9 and from 23.0.0 before 23.1.2, and @nx/maven from 22.0.2 before 22.7.9 and from 23.0.0 before 23.1.2. The plugins' project-graph analyzers run commands through a shell and insert plugin options from nx.json into command arguments, so shell syntax in those options is interpreted (CWE-78). A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with that user's privileges. Workspaces that do not register either affected plugin are not exposed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0014 3rd percentileScored 2026-11-07
Fix Fixed nx (nrwl): 22.7.9, 23.1.2maven (@nx): 22.7.9, 23.1.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nrwlnx21.0.0 to before 22.7.9; 23.0.0 to before 23.1.222.7.9, 23.1.2Patch availableCNA
Nxmaven21.0.0 to before 22.7.9; 23.0.0 to before 23.1.222.7.9, 23.1.2Patch availableCNA
Nxgradle21.0.0 to before 22.7.9; 23.0.0 to before 23.1.222.7.9, 23.1.2Patch availableCNA
—@nx/maven (npm)22.0.2 to before 22.7.922.7.9Patch availableGHSA-qm8w-vx34-5j9j
—@nx/maven (npm)23.0.0 to before 23.1.223.1.2Patch availableGHSA-qm8w-vx34-5j9j
—@nx/gradle (npm)21.0.0 to before 22.7.922.7.9Patch availableGHSA-qm8w-vx34-5j9j
—@nx/gradle (npm)23.0.0 to before 23.1.223.1.2Patch availableGHSA-qm8w-vx34-5j9j
  • nx Vendornrwl Affected 21.0.0 to before 22.7.9; 23.0.0 to before 23.1.2 Fixed in 22.7.9, 23.1.2 Patch available CNA
  • maven VendorNx Affected 21.0.0 to before 22.7.9; 23.0.0 to before 23.1.2 Fixed in 22.7.9, 23.1.2 Patch available CNA
  • gradle VendorNx Affected 21.0.0 to before 22.7.9; 23.0.0 to before 23.1.2 Fixed in 22.7.9, 23.1.2 Patch available CNA
  • @nx/maven (npm) Vendor— Affected 22.0.2 to before 22.7.9 Fixed in 22.7.9 Patch available GHSA-qm8w-vx34-5j9j
  • @nx/maven (npm) Vendor— Affected 23.0.0 to before 23.1.2 Fixed in 23.1.2 Patch available GHSA-qm8w-vx34-5j9j
  • @nx/gradle (npm) Vendor— Affected 21.0.0 to before 22.7.9 Fixed in 22.7.9 Patch available GHSA-qm8w-vx34-5j9j
  • @nx/gradle (npm) Vendor— Affected 23.0.0 to before 23.1.2 Fixed in 23.1.2 Patch available GHSA-qm8w-vx34-5j9j

Remediation

Upgrade nx, @nx/maven and @nx/gradle to 22.7.9 or 23.1.2, and upgrade nx together with each affected plugin to matching releases because the plugin fix depends on code in the nx package.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA nx (nrwl) Fixed in 22.7.9, 23.1.2
  • Fix · CNA maven (@nx) Fixed in 22.7.9, 23.1.2
  • Fix · CNA gradle (@nx) Fixed in 22.7.9, 23.1.2
  • Fix · GHSA-qm8w-vx34-5j9j @nx/maven (npm) Fixed in 22.7.9 Advisory →
  • Fix · GHSA-qm8w-vx34-5j9j @nx/maven (npm) Fixed in 23.1.2 Advisory →
  • Fix · GHSA-qm8w-vx34-5j9j @nx/gradle (npm) Fixed in 22.7.9 Advisory →
  • Fix · GHSA-qm8w-vx34-5j9j @nx/gradle (npm) Fixed in 23.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-119282
  2. 2026-10-30 Alias added: GHSA-qm8w-vx34-5j9j
  3. 2026-10-30 Fix available: npm/@nx/[email protected], npm/@nx/[email protected], npm/@nx/[email protected] +1 · GHSA-qm8w-vx34-5j9j
  4. 2026-10-30 CVSS score added · GHSA-qm8w-vx34-5j9j
  5. 2026-10-30 Weakness changed · GHSA-qm8w-vx34-5j9j
  6. 2026-10-30 9 new references · GHSA-qm8w-vx34-5j9j
  7. 2026-10-31 Priority changed: MEDIUM → LOW
  8. 2026-11-03 CISA SSVC decision points changed
  9. 2026-11-06 Affected versions changed · Red Hat
  10. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 8

  • TI-2026-50091 Nx: Zip-Slip in the self-hosted remote cache CVSS 4.0HIGH 8.7
  • TI-2026-66138 Nx daemon and plugin worker sockets are accessible to other local users CVSS 4.0HIGH 8.5
  • TI-2026-66140 Nx: OS command injection in the @nx/docker release pipeline CVSS 4.0HIGH 7.3
  • TI-2026-39559 Nx: `nx graph` dev server permissive CORS policy CVSS 3.1MEDIUM 5.9
  • TI-2026-66137 Nx: Path traversal in nx migrate package-migrations extraction CVSS 4.0MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences