---
id: CVE-2026-119282
aliases:
  - GHSA-qm8w-vx34-5j9j
title: '@nx/maven and @nx/gradle have OS command injection via nx.json plugin options'
summary: '@nx/maven and @nx/gradle have OS command injection via nx.json plugin options'
severity: high
cwe:
  - CWE-78
  - CWE-88
vendor: nx
product: '@nx/maven'
ecosystem: npm
affected:
  - '@nx/maven >= 22.0.2, < 22.7.9'
  - '@nx/maven >= 23.0.0, < 23.1.2'
  - '@nx/gradle >= 21.0.0, < 22.7.9'
  - '@nx/gradle >= 23.0.0, < 23.1.2'
patched:
  - '@nx/maven 22.7.9'
  - '@nx/maven 23.1.2'
  - '@nx/gradle 22.7.9'
  - '@nx/gradle 23.1.2'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T14:42:16Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-qm8w-vx34-5j9j'
references:
  - url: 'https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-119282'
  - url: 'https://github.com/nrwl/nx/pull/36626'
  - url: 'https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25'
  - url: 'https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548'
  - url: 'https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409'
  - url: 'https://github.com/nrwl/nx/releases/tag/22.7.9'
  - url: 'https://github.com/nrwl/nx/releases/tag/23.1.2'
  - url: 'https://github.com/advisories/GHSA-qm8w-vx34-5j9j'
tags:
  - ghsa
  - npm
epss: 0.0014
epssPercentile: 0.03377
ingestedAt: '2026-10-30T15:02:40.136Z'
---

## Overview

## Summary

`@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any `nx` command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits `nx.json`, runs the injected command with their own privileges.

## Severity

A victim who runs an ordinary `nx` command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write `nx.json` can already run code through the repository's build files (`./mvnw`, `pom.xml`, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where `nx.json` is writable but the build files are not. We have no evidence of exploitation in the wild.

## Affected & Patched Versions

| Package | Vulnerable | Patched |
| --- | --- | --- |
| `@nx/maven` | `>= 22.0.2, < 22.7.9`; `>= 23.0.0, < 23.1.2` | `22.7.9`, `23.1.2` |
| `@nx/gradle` | `>= 21.0.0, < 22.7.9`; `>= 23.0.0, < 23.1.2` | `22.7.9`, `23.1.2` |

> [!IMPORTANT]
> Workspaces that register neither `@nx/maven` nor `@nx/gradle` in `nx.json` are unaffected — the vulnerable code only runs from those plugins' graph-construction paths, and no other Nx plugin shares this pattern.

## Remediation

Upgrade to **22.7.9** (22.x line) or **23.1.2** (23.x line) or later:

```
nx migrate 23.1.2
```

Upgrade both `nx` and the affected plugin (`@nx/maven` and/or `@nx/gradle`). The plugin's fix depends on code that ships in the `nx` package, so bumping the plugin without a matching `nx` upgrade will not resolve it.

There is no configuration to change — upgrading is the whole fix. If you cannot upgrade yet, only run `nx` commands in repositories you trust, since a malicious `nx.json` can execute code on a vulnerable version.

## Details

Both plugins spawn their analyzer through a shell and interpolate `nx.json` plugin options into the command, so those option values are shell source. For Maven the injectable value is the `targetNamePrefix` option; for Gradle it is broader, since every plugin option is mapped into a `-P` argument and arbitrary option names are accepted, making both the name and value of any option injectable.

## Credits

- **Arkadiusz Marta** (RE:SOURCE) — Reporter

## Affected packages

- `@nx/maven >= 22.0.2, < 22.7.9`
- `@nx/maven >= 23.0.0, < 23.1.2`
- `@nx/gradle >= 21.0.0, < 22.7.9`
- `@nx/gradle >= 23.0.0, < 23.1.2`

## Remediation

Upgrade to a patched release:

- `@nx/maven 22.7.9`
- `@nx/maven 23.1.2`
- `@nx/gradle 22.7.9`
- `@nx/gradle 23.1.2`