High, CVSS 7.3npmAmendedPublished
@nx/docker: OS command injection in the @nx/docker release pipeline
CVE-2026-104859 · GHSA-6vc5-vf29-ffr2
- Affected
- npm @nx/docker >= 21.4.0, < 22.7.8; >= 23.0.0, < 23.1.1
- Fixed in
- 23.1.122.7.8· Vendor fix available
- Issue
- The @nx/docker release pipeline builds its docker invocations as shell command strings, interpolating release.docker.repositoryName and registryUrl from Nx configuration into them. Because those strings are handed to /bin/sh -c, a crafted repository or registry name executes as a command during nx release version and nx release publish. Anyone running a Docker release against a repository whose Nx configuration they do not control — or whose configuration a pull request has changed — executes the injected command with the privileges of the release job, which in CI typically holds registry credentials and cloud tokens. Severity Exploitable when someone runs a Docker release against attacker-supplied configuration, with high impact because release jobs hold publishing credentials. There is no known evidence of exploitation in the wild. Affected & Patched Versions | Package | Vulnerable | Patched | | --- | --- | --- | | @nx/docker | = 21.4.0, < 22.7.8; = 23.0.0, < 23.1.1 |…
Recommended action: Upgrade to 23.1.1 or 22.7.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.