Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.3 · nrwl, @nxNVD modified 2026-10-29 21:07
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j x_refsource_confirm
- https://github.com/nrwl/nx/pull/36626 x_refsource_misc
- https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25 x_refsource_misc
- https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548 x_refsource_misc
- https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409 x_refsource_misc
- https://github.com/nrwl/nx/releases/tag/22.7.9 x_refsource_misc
- https://github.com/nrwl/nx/releases/tag/23.1.2 x_refsource_misc