{"id":"CVE-2026-119282","aliases":["GHSA-qm8w-vx34-5j9j"],"title":"Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"## Summary\n\n`@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any `nx` command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits `nx.json`, runs the injected command with their own privileges.\n\n## Severity\n\nA victim who runs an ordinary `nx` command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write `nx.json` can already run code through the repository's build files (`./mvnw`, `pom.xml`, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where `nx.json` is writable but the build files are not. We have no evidence of exploitation in the wild.\n\n## Affected & Patched Versions\n\n| Package | Vulnerable | Patched |\n| --- | --- | --- |\n| `@nx/maven` | `>= 22.0.2, < 22.7.9`; `>= 23.0.0, < 23.1.2` | `22.7.9`, `23.1.2` |\n| `@nx/gradle` | `>= 21.0.0, < 22.7.9`; `>= 23.0.0, < 23.1.2` | `22.7.9`, `23.1.2` |\n\n> [!IMPORTANT]\n> Workspaces that register neither `@nx/maven` nor `@nx/gradle` in `nx.json` are unaffected — the vulnerable code only runs from those plugins' graph-construction paths, and no other Nx plugin shares this pattern.\n\n## Remediation\n\nUpgrade to **22.7.9** (22.x line) or **23.1.2** (23.x line) or later:\n\n```\nnx migrate 23.1.2\n```\n\nUpgrade both `nx` and the affected plugin (`@nx/maven` and/or `@nx/gradle`). The plugin's fix depends on code that ships in the `nx` package, so bumping the plugin without a matching `nx` upgrade will not resolve it.\n\nThere is no configuration to change — upgrading is the whole fix. If you cannot upgrade yet, only run `nx` commands in repositories you trust, since a malicious `nx.json` can execute code on a vulnerable version.\n\n## Details\n\nBoth plugins spawn their analyzer through a shell and interpolate `nx.json` plugin options into the command, so those option values are shell source. For Maven the injectable value is the `targetNamePrefix` option; for Gradle it is broader, since every plugin option is mapped into a `-P` argument and arbitrary option names are accepted, making both the name and value of any option injectable.\n\n## Credits\n\n- **Arkadiusz Marta** (RE:SOURCE) — Reporter","severity":"high","score":7.3,"published":"2026-10-29T21:07:46.468Z","modified":"2026-10-30T14:45:04.467Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"@nx/maven","sources":[{"name":"OSV · GHSA-qm8w-vx34-5j9j","url":"https://osv.dev/vulnerability/GHSA-qm8w-vx34-5j9j"}],"ranges":[{"events":[{"introduced":"22.0.2"},{"fixed":"22.7.9"}],"type":"SEMVER"}],"versions":[],"fixed":["22.7.9"]},{"ecosystem":"npm","name":"@nx/maven","sources":[{"name":"OSV · GHSA-qm8w-vx34-5j9j","url":"https://osv.dev/vulnerability/GHSA-qm8w-vx34-5j9j"}],"ranges":[{"events":[{"introduced":"23.0.0"},{"fixed":"23.1.2"}],"type":"SEMVER"}],"versions":[],"fixed":["23.1.2"]},{"ecosystem":"npm","name":"@nx/gradle","sources":[{"name":"OSV · GHSA-qm8w-vx34-5j9j","url":"https://osv.dev/vulnerability/GHSA-qm8w-vx34-5j9j"}],"ranges":[{"events":[{"introduced":"21.0.0"},{"fixed":"22.7.9"}],"type":"SEMVER"}],"versions":[],"fixed":["22.7.9"]},{"ecosystem":"npm","name":"@nx/gradle","sources":[{"name":"OSV · GHSA-qm8w-vx34-5j9j","url":"https://osv.dev/vulnerability/GHSA-qm8w-vx34-5j9j"}],"ranges":[{"events":[{"introduced":"23.0.0"},{"fixed":"23.1.2"}],"type":"SEMVER"}],"versions":[],"fixed":["23.1.2"]}],"sourceAffected":[],"references":["https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","https://github.com/nrwl/nx/pull/36626","https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2","https://nvd.nist.gov/vuln/detail/CVE-2026-119282","https://github.com/nrwl/nx"],"sources":[{"name":"CVE","id":"CVE-2026-119282","modified":"2026-10-29T21:07:46.468Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119282"},{"name":"OSV","id":"GHSA-qm8w-vx34-5j9j","modified":"2026-10-30T14:45:04.467456896Z","url":"https://osv.dev/vulnerability/GHSA-qm8w-vx34-5j9j"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3},{"source":"OSV","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3}],"cve":{"records":[{"id":"CVE-2026-119282","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T18:50:28.064Z","published":"2026-10-29T21:07:46.468Z","modified":"2026-10-29T21:07:46.468Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T21:07:46.468Z"}],"references":[{"url":"https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/nrwl/nx/pull/36626","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nrwl/nx/releases/tag/22.7.9","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nrwl/nx/releases/tag/23.1.2","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"GitHub_M"},{"id":"CWE-88","description":"CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"nrwl","name":"nx","platforms":[],"versions":[{"version":">= 21.0.0, < 22.7.9","status":"affected"},{"version":">= 23.0.0, < 23.1.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119282"},{"vendor":"@nx","name":"maven","platforms":[],"versions":[{"version":">= 21.0.0, < 22.7.9","status":"affected"},{"version":">= 23.0.0, < 23.1.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119282"},{"vendor":"@nx","name":"gradle","platforms":[],"versions":[{"version":">= 21.0.0, < 22.7.9","status":"affected"},{"version":">= 23.0.0, < 23.1.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119282"}],"remediation":[],"observedAt":"2026-10-30T17:03:32.819Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T13:30:33.323Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T01:25:33.202Z","attemptedAt":"2026-10-30T01:25:33.202Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T01:25:32.725Z","attemptedAt":"2026-10-30T01:25:32.725Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T01:25:32.634Z","attemptedAt":"2026-10-30T01:25:32.634Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T01:25:32.574Z","attemptedAt":"2026-10-30T01:25:32.574Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113391","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113391","modified":"Oct 29, 2026, 9:07:46 PM","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-10-30T01:25:32.634Z"},{"source":"NVD","id":"CVE-2026-119282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119282","modified":"2026-10-29T22:17:00.887","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T01:25:33.202Z"}],"aiSummary":null}