CVE-2026-119282

Received Received - Intake

Command Injection in Nx Monorepo Tool

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: GitHub, Inc.

Description

Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-29

Last Modified

2026-10-29

Generated

2026-10-30

AI Q&A

2026-10-30

EPSS Evaluated

N/A

NVD

CVE-2026-119282

EUVD

EUVD-2026-113391

Affected Vendors & Products

Vendor	Product	Version / Range
nrwl	nx	>= 21.0.0, < 22.7.9
nrwl	nx	>= 23.0.0, < 23.1.2
@nx	maven	>= 21.0.0, < 22.7.9
@nx	maven	>= 23.0.0, < 23.1.2
@nx	gradle	>= 21.0.0, < 22.7.9
@nx	gradle	>= 23.0.0, < 23.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Nx monorepo tool for TypeScript and polyglot codebases. It allows command injection through shell interpolation of plugin options in nx.json. Attackers can execute arbitrary commands if a user runs Nx in a malicious repository or pull request. The issue exists in specific versions of Nx and its @nx/maven and @nx/gradle plugins.

Detection Guidance

Check your Nx version and affected plugins (@nx/maven, @nx/gradle) using commands like 'nx --version' or 'npm list @nx/maven @nx/gradle'. If versions are below 22.7.9 or 23.1.2, the system may be vulnerable.

Impact Analysis

If you use Nx in an attacker-controlled environment, an attacker could execute commands with your privileges. This could lead to data theft, system compromise, or further network access. Workspaces without the affected plugins are not vulnerable.

Mitigation Strategies

Upgrade Nx to version 22.7.9 or 23.1.2 and update affected plugins (@nx/maven, @nx/gradle) to matching releases. Avoid running Nx in untrusted repositories or pull requests.

Hi! I’m here to help you understand CVE-2026-119282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70