{"id":"EUVD-2026-113391","revision":null,"records":[{"revision":"c908bba893b2435889f28d1dbb5afb7e","observedAt":"2026-11-03T17:57:17.031+00:00","statement":{"source":"cve-program","id":"CVE-2026-119282","aliases":[],"title":"Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle","description":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.","state":0,"publishedAt":"2026-10-29T21:07:46.468+00:00","modifiedAt":"2026-11-03T16:50:52.627+00:00","affected":[{"ecosystem":"Vendor product","name":"nx","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nrwl\",\n                    \"product\": \"nx\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 21.0.0, < 22.7.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 23.0.0, < 23.1.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"maven","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@nx\",\n                    \"product\": \"maven\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 21.0.0, < 22.7.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 23.0.0, < 23.1.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"gradle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@nx\",\n                    \"product\": \"gradle\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 21.0.0, < 22.7.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 23.0.0, < 23.1.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3,"severity":"HIGH"}],"references":["https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","https://github.com/nrwl/nx/pull/36626","https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119282","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-119282","identifiers":["CVE-2026-119282"]},"retained":false,"historicalAffected":[]},{"revision":"4d2387b815324ac89cede5828a552930","observedAt":"2026-11-13T21:02:59.791+00:00","statement":{"source":"euvd","id":"EUVD-2026-113391","aliases":["CVE-2026-119282","GHSA-qm8w-vx34-5j9j"],"title":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and inte…","description":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3,"severity":null}],"references":["https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","https://github.com/nrwl/nx/pull/36626","https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113391","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 29, 2026, 9:07:46 PM","dateUpdated":"Nov 3, 2026, 4:50:52 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-113391","identifiers":["EUVD-2026-113391","CVE-2026-119282","GHSA-qm8w-vx34-5j9j"]},"retained":false,"historicalAffected":[]},{"revision":"1f6313594c38495e869a1b7781151950","observedAt":"2026-11-05T16:36:37.072+00:00","statement":{"source":"nvd","id":"CVE-2026-119282","aliases":[],"title":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and inte…","description":"Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.","state":0,"publishedAt":"2026-10-29T22:17:00.887+00:00","modifiedAt":"2026-11-03T17:18:05.677+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.3,"severity":"HIGH"}],"references":["https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","https://github.com/nrwl/nx/pull/36626","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2","https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-119282","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-78","CWE-88"],"productCriteria":[],"sourceDates":{"published":"2026-10-29T22:17:00.887","lastModified":"2026-11-03T17:18:05.677"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-119282","identifiers":["CVE-2026-119282"]},"retained":false,"historicalAffected":[]},{"revision":"e08dd5897a884219b6e31f9b116580ee","observedAt":"2026-10-30T15:45:48.751+00:00","statement":{"source":"osv","id":"GHSA-qm8w-vx34-5j9j","aliases":["CVE-2026-119282"],"title":"@nx/maven and @nx/gradle have OS command injection via nx.json plugin options","description":"## Summary\n\n`@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any `nx` command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits `nx.json`, runs the injected command with their own privileges.\n\n## Severity\n\nA victim who runs an ordinary `nx` command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write `nx.json` can already run code through the repository's build files (`./mvnw`, `pom.xml`, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where `nx.json` is writable but the build files are not. We have no evidence of exploitation in the wild.\n\n## Affected & Patched Versions\n\n| Package | Vulnerable | Patched |\n| --- | --- | --- |\n| `@nx/maven` | `>= 22.0.2, < 22.7.9`; `>= 23.0.0, < 23.1.2` | `22.7.9`, `23.1.2` |\n| `@nx/gradle` | `>= 21.0.0, < 22.7.9`; `>= 23.0.0, < 23.1.2` | `22.7.9`, `23.1.2` |\n\n> [!IMPORTANT]\n> Workspaces that register neither `@nx/maven` nor `@nx/gradle` in `nx.json` are unaffected — the vulnerable code only runs from those plugins' graph-construction paths, and no other Nx plugin shares this pattern.\n\n## Remediation\n\nUpgrade to **22.7.9** (22.x line) or **23.1.2** (23.x line) or later:\n\n```\nnx migrate 23.1.2\n```\n\nUpgrade both `nx` and the affected plugin (`@nx/maven` and/or `@nx/gradle`). The plugin's fix depends on code that ships in the `nx` package, so bumping the plugin without a matching `nx` upgrade will not resolve it.\n\nThere is no configuration to change — upgrading is the whole fix. If you cannot upgrade yet, only run `nx` commands in repositories you trust, since a malicious `nx.json` can execute code on a vulnerable version.\n\n## Details\n\nBoth plugins spawn their analyzer through a shell and interpolate `nx.json` plugin options into the command, so those option values are shell source. For Maven the injectable value is the `targetNamePrefix` option; for Gradle it is broader, since every plugin option is mapped into a `-P` argument and arbitrary option names are accepted, making both the name and value of any option injectable.\n\n## Credits\n\n- **Arkadiusz Marta** (RE:SOURCE) — Reporter","state":0,"publishedAt":"2026-10-30T14:42:14+00:00","modifiedAt":"2026-10-30T14:45:04.4674569+00:00","affected":[{"ecosystem":"npm","name":"@nx/maven","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"22.0.2"},{"kind":"fixed","version":"22.7.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@nx/maven","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"23.0.0"},{"kind":"fixed","version":"23.1.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@nx/gradle","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"21.0.0"},{"kind":"fixed","version":"22.7.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@nx/gradle","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"23.0.0"},{"kind":"fixed","version":"23.1.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j","https://nvd.nist.gov/vuln/detail/CVE-2026-119282","https://github.com/nrwl/nx/pull/36626","https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25","https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548","https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409","https://github.com/nrwl/nx","https://github.com/nrwl/nx/releases/tag/22.7.9","https://github.com/nrwl/nx/releases/tag/23.1.2"],"sourceUrl":"https://github.com/advisories/GHSA-qm8w-vx34-5j9j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qm8w-vx34-5j9j","identifiers":["GHSA-qm8w-vx34-5j9j","CVE-2026-119282"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-14T22:23:25.3649968+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-14T22:23:25.3649968+00:00","lastSuccessAt":"2026-11-14T22:23:25.5243904+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.5243923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-f4305fb3b9417bd97547e9305731a80b9463cd5f49ef853b3cd62960cad53a57-9d76cdc37374a39108af9d8e6d28e9f332b86df6fe9d743ff6a15196e42cc1d5","complete":true,"records":425755,"lastAttemptAt":"2026-11-14T22:23:24.6996834+00:00","lastSuccessAt":"2026-11-14T22:23:24.6584535+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:24.6996834+00:00","snapshotPublishedAt":"2026-11-14T22:18:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-893872a78a5a49b395e1d5e440abfb7e","complete":true,"records":13821,"lastAttemptAt":"2026-11-14T22:24:06.7670242+00:00","lastSuccessAt":"2026-11-14T22:24:06.761+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:24:06.761+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-14T22:23:25.3649968+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-14T22:23:25.3649968+00:00","lastSuccessAt":"2026-11-14T22:23:25.5255142+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.5255147+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-22057fabdc264e74ae1f49b63790ef7e","complete":false,"records":13821,"lastAttemptAt":"2026-11-14T22:23:57.7555434+00:00","lastSuccessAt":"2026-11-14T22:23:57.752+00:00","error":"344 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-14T22:23:57.752+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13530,"expectedIdentifiers":13874,"failedIdentifiers":344},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-14T22:23:25.1321415+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.1321415+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-14T22:23:24.8437001+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:24.8437001+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-14T22:23:25.3249929+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.3249929+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-bfbc75e561bfffdd0ad20c592902934adbd2d0a701402c5539bbccd9991fe78c","complete":true,"records":232472,"lastAttemptAt":"2026-11-14T22:23:24.9477452+00:00","lastSuccessAt":"2026-11-14T21:27:13.9659762+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:24.9477452+00:00","snapshotPublishedAt":"2026-11-14T20:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}