CVE-2026-119282: OS Command Injection via Plugin Options in Nx (@nx/maven and @nx/gradle)

Vulnerability ID: CVE-2026-119282
CVSS Score: 7.3
Published: 2026-10-30

An OS command injection and argument injection vulnerability exists in the Nx build system and its official Maven (@nx/maven) and Gradle (@nx/gradle) plugins. When constructing the project dependency graph, the plugins invoke underlying Java build wrappers via subshells while interpolating unsanitized plugin options directly from nx.json into the command arguments. An attacker who supplies a crafted nx.json file via a repository or pull request can execute arbitrary shell commands with the privileges of the user or CI/CD runner invoking any Nx command that computes the project graph.

TL;DR

Nx versions prior to 22.7.9 and 23.1.2 pass unvalidated configuration options from nx.json into child process executions with shell: true in @nx/maven and @nx/gradle. Running Nx commands in an untrusted repository or pull request allows arbitrary OS command execution.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Class: OS Command Injection (CWE-78) / Argument Injection (CWE-88)
• CVSS v4.0 Score: 7.3 HIGH (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
• Attack Vector: Local via untrusted nx.json in repository or pull request
• Affected Components: nx, @nx/maven, @nx/gradle (>= 21.0.0, < 22.7.9 and >= 23.0.0, < 23.1.2)
• Patched Versions: 22.7.9 and 23.1.2
• EPSS Score: 0.14% (3.38th percentile)
• CISA KEV Status: Not Listed

Affected Systems

• nx
• @nx/maven
• @nx/gradle
• nx: >= 21.0.0, < 22.7.9 (Fixed in: 22.7.9)
• nx: >= 23.0.0, < 23.1.2 (Fixed in: 23.1.2)
• @nx/maven: >= 21.0.0, < 22.7.9 (Fixed in: 22.7.9)
• @nx/maven: >= 23.0.0, < 23.1.2 (Fixed in: 23.1.2)
• @nx/gradle: >= 21.0.0, < 22.7.9 (Fixed in: 22.7.9)
• @nx/gradle: >= 23.0.0, < 23.1.2 (Fixed in: 23.1.2)

Code Analysis

Commit: 02c5d59

Introduce safeSpawn and safeExecFileSync utilities and replace shell: true invocations in @nx/maven and @nx/gradle.

Commit: 60196b7

Backport safeSpawn and plugin analyzer security fixes for CVE-2026-119282.

Commit: c227f47

Release commit containing fixes for @nx/maven and @nx/gradle command injection.

Mitigation Strategies

• Upgrade both the core nx package and any installed @nx/maven or @nx/gradle plugins to matched release versions 22.7.9 or 23.1.2.
• Enforce strict code review requirements on nx.json using repository CODEOWNERS rules, treating it with the same sensitivity as CI workflow definitions and build scripts.
• Isolate CI/CD execution on untrusted pull requests so that nx commands do not run with access to production secrets or write permissions before human review.

Remediation Steps:

1. Identify whether @nx/maven or @nx/gradle is installed in package.json or configured in nx.json.
2. Run 'nx migrate 22.7.9' (for 22.x workspaces) or 'nx migrate 23.1.2' (for 23.x workspaces) to update package.json dependencies.
3. Install the updated packages using your package manager (npm install, yarn, or pnpm install).
4. Verify that node_modules/nx, node_modules/@nx/devkit, node_modules/@nx/maven, and node_modules/@nx/gradle all resolve to version 22.7.9 or 23.1.2+.

References

• GitHub Security Advisory GHSA-qm8w-vx34-5j9j
• NVD - CVE-2026-119282 Detail
• CVE.org Record: CVE-2026-119282
• CVEListV5 Official JSON Record for CVE-2026-119282
• GitHub Pull Request #36626 - Fix Command Injection in Maven and Gradle Plugins
• Fix Commit 02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
• Fix Commit 60196b7cfcffcada35b6b90e53bf1a78d049b548
• Fix Commit c227f4780b054c512965c73aa480a48f9f781409
• Nx Release 22.7.9
• Nx Release 23.1.2

Read the full report for CVE-2026-119282 on our website for more details including interactive diagrams and full exploit analysis.