CVE-2026-119282 in Nrwl
Summary
by MITRE • 10/29/2026
Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified involves a command injection flaw within the Nx monorepo management tool, specifically affecting its project graph analysis capabilities for Maven and Gradle plugins. Versions of nx/maven from 22.0.2 through 22.7.9 and 23.1.2, as well as versions of nx/gradle from 21.0.0 through 22.7.9 and 23.1.2, are susceptible to this issue due to improper handling of configuration inputs during the construction of the project graph. The core technical flaw lies in how these plugins process options defined in the nx.json configuration file. When an Nx command is executed to analyze or construct the project graph, the tool launches a shell process and interpolates plugin-specific settings directly into command-line arguments without adequate sanitization or escaping. This design choice creates a pathway for arbitrary code execution if malicious values are introduced into these configuration fields.
In the context of nx/maven, the targetNamePrefix setting is vulnerable to injection. Similarly, in nx/gradle, both option names and their corresponding values can be exploited. Because these inputs are passed directly to a shell interpreter without proper validation, an attacker who controls the repository content or submits a pull request containing malicious configuration data can inject arbitrary shell commands. These injected commands will then execute with the privileges of the user running the Nx command. This poses a significant risk in continuous integration and development environments where automated builds run under specific service accounts or developer credentials, potentially leading to full system compromise if those accounts have elevated permissions.
The operational impact is severe because it allows for remote code execution within the build environment without requiring authentication beyond access to the repository source code. An attacker does not need direct shell access; they only need the ability to modify configuration files such as nx.json or submit changes that alter how plugins interpret project metadata. This vulnerability aligns with CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. It also relates to ATT&CK technique T1059, specifically sub-techniques involving command and scripting interpreters like sh or bash, where the attacker leverages legitimate system processes to execute malicious payloads.
Mitigation strategies must focus on immediate version upgrades and configuration hygiene. The issue is resolved in Nx versions 22.7.9 and 23.1.2 for both Maven and Gradle plugins. It is critical that organizations upgrade not only the core nx package but also all affected plugin packages to their corresponding patched versions, as the fix relies on coordinated code changes between the main framework and its extensions. For environments where upgrading immediately is not feasible, temporary mitigations include restricting write access to configuration files like nx.json to trusted personnel only and auditing pull requests for any modifications to Maven target prefixes or Gradle option definitions. Additionally, implementing strict input validation in CI/CD pipelines can help detect anomalous command structures before they are executed by the build system.