CVE-2026-119282 with a CVSS score of 7.3 is a command injection vulnerability in the @nx/maven and @nx/gradle plugins, where project-graph analyzers are spawned through a shell and plugin options read from nx.json are interpolated directly into the command line. The affected versions are @nx/maven (npm) versions >= 22.0.2, < 22.7.9 and >= 23.0.0, < 23.1.2, and @nx/gradle (npm) versions >= 21.0.0, < 22.7.9 and >= 23.0.0, < 23.1.2. An attacker who can supply or modify nx.json in a repository or pull request can embed shell syntax in option values; for Maven the injectable value is targetNamePrefix, while for Gradle arbitrary option names and values can be injected through -P arguments. When a victim clones the hostile repository, checks out the pull request, or otherwise runs an ordinary nx command that constructs the project graph, the shell parses the malicious line and executes the attacker-controlled command with the victim’s own privileges. This local attack requires no prior authentication but does require user interaction and a workspace that registers one of the affected plugins. The business impact is unauthorized code execution on developer machines or build systems, potentially leading to credential theft, source-code tampering, malicious artifact injection, lateral movement, and compromise of continuous integration pipelines.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-119282 with a CVSS score of 7.3 is a command injection vulnerability in the @nx/maven and @nx/gradle plugins, where project-graph analyzers are spawned through a shell and plugin options read from nx.json are interpolated directly into the command line. The affected versions are @nx/maven (npm) versions >= 22.0.2, < 22.7.9 and >= 23.0.0, < 23.1.2, and @nx/gradle (npm) versions >= 21.0.0, < 22.7.9 and >= 23.0.0, < 23.1.2. An attacker who can supply or modify nx.json in a repository or pull request can embed shell syntax in option values; for Maven the injectable value is targetNamePrefix, while for Gradle arbitrary option names and values can be injected through -P arguments. When a victim clones the hostile repository, checks out the pull request, or otherwise runs an ordinary nx command that constructs the project graph, the shell parses the malicious line and executes the attacker-controlled command with the victim’s own privileges. This local attack requires no prior authentication but does require user interaction and a workspace that registers one of the affected plugins. The business impact is unauthorized code execution on developer machines or build systems, potentially leading to credential theft, source-code tampering, malicious artifact injection, lateral movement, and compromise of continuous integration pipelines.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]