CVE-2026-119282

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548
https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409
https://github.com/nrwl/nx/pull/36626
https://github.com/nrwl/nx/releases/tag/22.7.9
https://github.com/nrwl/nx/releases/tag/23.1.2
https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j

Configurations

No configuration.

History

29 Oct 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-29 22:17

Updated : 2026-10-30 19:37

NVD link : CVE-2026-119282

Mitre link : CVE-2026-119282

CVE.ORG link : CVE-2026-119282

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-119282", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nrwl", "product": "nx", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}, {"vendor": "@nx", "product": "maven", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}, {"vendor": "@nx", "product": "gradle", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}]}], "published": "2026-10-29T22:17:00.887", "references": [{"url": "https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/pull/36626", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/releases/tag/22.7.9", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/releases/tag/23.1.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2."}], "lastModified": "2026-10-30T19:37:07.073", "sourceIdentifier": "security-advisories@github.com"}