Command Injection Vulnerability in Nx Monorepo Solution for TypeScript and Polyglot Codebases
CVE-2026-119282
What is CVE-2026-119282?
A command injection vulnerability exists in the Nx Monorepo Solution, affecting specific versions of the Nx package and its plugins, @nx/maven and @nx/gradle. When the project-graph analyzers are launched, they interpolate options from the nx.json file into command arguments, which can interpret certain values as shell syntax. This poses a risk for users running Nx in repositories or pull requests controlled by attackers, allowing the execution of arbitrary commands with the user's privileges. To mitigate this risk, users must upgrade both nx and the affected plugins to the latest corresponding versions: 22.7.9 for Nx and 23.1.2 for the plugins.
Affected Version(s)
gradle >= 21.0.0, < 22.7.9 < 21.0.0, 22.7.9
gradle >= 23.0.0, < 23.1.2 < 23.0.0, 23.1.2
maven >= 21.0.0, < 22.7.9 < 21.0.0, 22.7.9