CVE-2026-104859High· 7.3▾ TwilightNx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl configuration values are interpolated into those strings and passed to /bin/sh -c, allowing shell syntax in untrusted Nx configuration to execute during nx release version or nx release publish. A pull request or repository configuration change can therefore execute commands with the release job's privileges and expose registry credentials or cloud tokens, and dry-run publishing does not prevent the vulnerable pre-check command from executing. This issue is fixed in versions 22.7.8 and 23.1.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@nx/docker >= 21.4.0, < 22.7.8@nx/docker >= 23.0.0, < 23.1.1Patched in:
@nx/docker 22.7.8@nx/docker 23.1.1Connected by shared product, vendor, weakness, or advisory.
GHSA-w2vw-w76x-qr89HighNx: OS command injection via git revisions and remote refs
CVE-2026-104854High· 8.5Nx is a monorepo solution for TypeScript and polyglot codebases
CVE-2026-104853Medium· 5.8Nx is a monorepo solution for TypeScript and polyglot codebases
CVE-2026-71476HighNx is a monorepo solution for TypeScript and polyglot codebases
CVE-2026-54753Medium· 5.9`nx graph` dev server permissive CORS policy
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …