Zero Radar
← feed
HighVulnerabilityCVE-2026-119282updated 30 Oct 2026, 14:43 UTC

Nx Maven and Gradle plugins can run attacker commands from nx.json

If you open or run Nx in a project someone else controls, a booby-trapped setting in its nx.json file can make your computer run hidden commands as you. Updating Nx closes this hole.

Fix available · out Official, 2 sources
SeverityHighCVSS 7.3 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?Yes@nx/maven and @nx/gradle 22.7.9 (22.x line) or 23.1.2 (23.x line), together with a matching nx upgrade · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Malicious authorEdits nx.json in a repo or pull request
  2. 2Hostile repositoryVictim clones or checks out the code
  3. 3Run nx commandProject graph build starts the analyzer
  4. 4Shell injectionnx.json option values run as shell commands
  5. ResultAttacker commands run as the victim

What happened

The @nx/maven and @nx/gradle plugins launch their project-graph analyzer through a shell and insert plugin options read from nx.json directly into the command line, so shell syntax in those option values gets executed whenever an nx command builds the project graph.

Why it is dangerous: Anyone who clones a hostile repository or checks out a pull request editing nx.json can get code run with their own privileges, which is most dangerous in CI systems that build untrusted forks where build files are protected but nx.json is not.

Are you affected?

You are affected if you use @nx/maven 22.0.2 to before 22.7.9, or 23.0.0 to before 23.1.2, or @nx/gradle 21.0.0 to before 22.7.9, or 23.0.0 to before 23.1.2, in a workspace that registers that plugin in nx.json.

Package / productAffected versionsFixed in
@nx/maven · npm>= 22.0.2, < 22.7.922.7.9
@nx/maven · npm>= 23.0.0, < 23.1.223.1.2
@nx/gradle · npm>= 21.0.0, < 22.7.922.7.9
@nx/gradle · npm>= 23.0.0, < 23.1.223.1.2

What to do

  1. Run 'nx migrate 23.1.2' (or 22.7.9 on the 22.x line) to upgrade nx and plugins together
  2. Upgrade both nx and each affected plugin (@nx/maven and/or @nx/gradle), not just the plugin
  3. Until upgraded, only run nx commands in repositories you trust

Timeline

  1. 29 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 22:17 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 14:43 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 14:43 UTC
    Fixed version published: @nx/maven 22.7.9, @nx/maven 23.1.2, @nx/gradle 22.7.9 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119282 · GHSA-qm8w-vx34-5j9j
CVSS
7.3 / 10
Disclosed
29 Oct 2026, 22:17 UTC
On Zero Radar
29 Oct 2026, 22:17 UTC (0 min after disclosure)
Last change
30 Oct 2026, 14:43 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Nx Maven and Gradle plugins can run attacker commands from nx.json · Zero Radar