EUVD-2026-113391Published
Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-119282 · CVE overview and exploitation status
cve-program · CVE-2026-119282
- https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j
- https://github.com/nrwl/nx/pull/36626
- https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
- https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548
- https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409
- https://github.com/nrwl/nx/releases/tag/22.7.9
- https://github.com/nrwl/nx/releases/tag/23.1.2
euvd · EUVD-2026-113391
- https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j
- https://github.com/nrwl/nx/pull/36626
- https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
- https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548
- https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409
- https://github.com/nrwl/nx/releases/tag/22.7.9
- https://github.com/nrwl/nx/releases/tag/23.1.2
nvd · CVE-2026-119282
- https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
- https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548
- https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409
- https://github.com/nrwl/nx/pull/36626
- https://github.com/nrwl/nx/releases/tag/22.7.9
- https://github.com/nrwl/nx/releases/tag/23.1.2
- https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j
osv · GHSA-qm8w-vx34-5j9j
- https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j
- https://nvd.nist.gov/vuln/detail/CVE-2026-119282
- https://github.com/nrwl/nx/pull/36626
- https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
- https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548
- https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409
- https://github.com/nrwl/nx
- https://github.com/nrwl/nx/releases/tag/22.7.9
- https://github.com/nrwl/nx/releases/tag/23.1.2
Related changes
Linked by CVE identifier- Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and inte… · Advisory content revised · 1 Nov 2026
- Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and inte… · Advisory content revised · 1 Nov 2026
- @nx/maven and @nx/gradle have OS command injection via nx.json plugin options · Newly collected advisory · 30 Oct 2026
- Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle · Newly collected advisory · 29 Oct 2026