High, CVSS 7.3npmAmendedPublished
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
CVE-2026-119282 · GHSA-qm8w-vx34-5j9j
- Affected
- npm @nx/maven >= 22.0.2, < 22.7.9; >= 23.0.0, < 23.1.2
- Fixed in
- 22.7.923.1.2· Vendor fix available
- Issue
- `@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any `nx` command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits `nx.json`, runs the injected command with their own privileges. Severity A victim who runs an ordinary `nx` command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write `nx.json` can already run code through the repository's build files (`./mvnw`, `pom.xml`, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where `nx.json` is writable but the build files are not. We have no evidence of exploitation in the wild. Affected &…
Recommended action: Upgrade to 23.1.2 or 22.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.