CVE-2026-119282
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Nx from 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can be interpreted as shell syntax.
Risk Assessment
A user running Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges.
Recommendation
Upgrade both nx and each affected plugin to matching releases 22.7.9 or 23.1.2. The plugin fix depends on code in the nx package, so both components require updating.
Other vulnerabilities in Nx
See all- CVE-2026-104859High
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds shell command strings from configuration values, which are executed via /bin/sh -c. This allows shell syntax in untrusted Nx configuration to execute during release operations, potentially exposing registry credentials or cloud tokens.
- CVE-2026-104854High
Nx from 14.6.0 until 22.7.9 and 23.1.2 creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only permissions. Another unprivileged local account can connect to a running socket because the transport performs no authentication. The daemon's PROCESS_IN_BACKGROUND request can execute code as the account running Nx. Fixed in versions 22.7.9 and 23.1.2.
- CVE-2026-104853Medium
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile dependency can supply .. segments or an absolute path, causing the migration archive to write attacker-controlled bytes outside the temporary directory or truncate an existing writable file.
- CVE-2026-71476High
Vulnerability in Nx (versions 20.8.0 to 22.7.7 and 23.0.2) in the self-hosted HTTP remote cache. A malicious cache server can return a crafted tar archive that writes files outside the cache directory, potentially leading to remote code execution.
Original NVD description (English source)
Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS