CVE-2026-119282

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119282", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.064Z", "datePublished": "2026-10-29T21:07:46.468Z", "dateUpdated": "2026-11-03T16:50:52.627Z"}, "containers": {"cna": {"title": "Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-88", "lang": "en", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j"}, {"name": "https://github.com/nrwl/nx/pull/36626", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/pull/36626"}, {"name": "https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25"}, {"name": "https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548"}, {"name": "https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409"}, {"name": "https://github.com/nrwl/nx/releases/tag/22.7.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/releases/tag/22.7.9"}, {"name": "https://github.com/nrwl/nx/releases/tag/23.1.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/nrwl/nx/releases/tag/23.1.2"}], "affected": [{"vendor": "nrwl", "product": "nx", "versions": [{"version": ">= 21.0.0, < 22.7.9", "status": "affected"}, {"version": ">= 23.0.0, < 23.1.2", "status": "affected"}]}, {"vendor": "@nx", "product": "maven", "versions": [{"version": ">= 21.0.0, < 22.7.9", "status": "affected"}, {"version": ">= 23.0.0, < 23.1.2", "status": "affected"}]}, {"vendor": "@nx", "product": "gradle", "versions": [{"version": ">= 21.0.0, < 22.7.9", "status": "affected"}, {"version": ">= 23.0.0, < 23.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T21:07:46.468Z"}, "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2."}], "source": {"advisory": "GHSA-qm8w-vx34-5j9j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T16:48:35.280950Z", "id": "CVE-2026-119282", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:50:52.627Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119282", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T16:48:35.280950Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:50:11.759Z"}}], "cna": {"title": "Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle", "source": {"advisory": "GHSA-qm8w-vx34-5j9j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nrwl", "product": "nx", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}, {"vendor": "@nx", "product": "maven", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}, {"vendor": "@nx", "product": "gradle", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}], "references": [{"url": "https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j", "name": "https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nrwl/nx/pull/36626", "name": "https://github.com/nrwl/nx/pull/36626", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25", "name": "https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548", "name": "https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409", "name": "https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nrwl/nx/releases/tag/22.7.9", "name": "https://github.com/nrwl/nx/releases/tag/22.7.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nrwl/nx/releases/tag/23.1.2", "name": "https://github.com/nrwl/nx/releases/tag/23.1.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T21:07:46.468Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119282", "state": "PUBLISHED", "dateUpdated": "2026-11-03T16:50:52.627Z", "dateReserved": "2026-10-29T18:50:28.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T21:07:46.468Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nx", "vendor": "nrwl", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}, {"product": "maven", "vendor": "@nx", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}, {"product": "gradle", "vendor": "@nx", "versions": [{"status": "affected", "version": ">= 21.0.0, < 22.7.9"}, {"status": "affected", "version": ">= 23.0.0, < 23.1.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2."}], "id": "CVE-2026-119282", "lastModified": "2026-11-03T17:18:05.677", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119282", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T16:48:35.280950Z", "version": "2.0.3"}}]}, "published": "2026-10-29T22:17:00.887", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/pull/36626"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/releases/tag/22.7.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/releases/tag/23.1.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-88"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@nx/maven: @nx/gradle: Nx: Arbitrary command execution via command injection in Maven and Gradle plugins", "id": "2563701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563701"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.", "A flaw was found in Nx. The project-graph analyzers in the Maven and Gradle plugins interpolate workspace configuration options directly into shell command arguments without adequate sanitization. An attacker who convinces a user to run Nx within a malicious repository or pull request can exploit this vulnerability to execute arbitrary commands with the privileges of the executing user."], "name": "CVE-2026-119282", "public_date": "2026-10-29T21:07:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119282\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119282\nhttps://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25\nhttps://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548\nhttps://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409\nhttps://github.com/nrwl/nx/pull/36626\nhttps://github.com/nrwl/nx/releases/tag/22.7.9\nhttps://github.com/nrwl/nx/releases/tag/23.1.2\nhttps://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j"], "statement": "This vulnerability is rated as Important severity for Red Hat environments because successful exploitation enables arbitrary command execution with the privileges of the local user, though it requires convincing a user to inspect or process an untrusted repository. The impact is confined to workflows utilizing the optional Maven or Gradle graph-analyzer plugins within workspace settings. Workspaces that do not configure these integrations are unaffected by this command injection path.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,22.7.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,23.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "gradle", "source": "cna", "vendor": "@nx"}, "product": "gradle", "vendor": "nrwl"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,22.7.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,23.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "maven", "source": "cna", "vendor": "@nx"}, "product": "maven", "vendor": "nrwl"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0,22.7.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,23.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nx", "source": "cna", "vendor": "nrwl"}, "product": "nx", "vendor": "nrwl"}], "created": "2026-10-29T22:30:13.627647+00:00", "updated": "2026-10-30T23:13:41.489250+00:00", "vendors": ["nrwl", "nrwl$PRODUCT$gradle", "nrwl$PRODUCT$maven", "nrwl$PRODUCT$nx"]}