{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@nx/maven--22.0.2--22.7.9--23.0.0--23.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-119282"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@nx/maven (\u003e= 22.0.2, \u003c 22.7.9; \u003e= 23.0.0, \u003c 23.1.2)","@nx/gradle (\u003e= 21.0.0, \u003c 22.7.9; \u003e= 23.0.0, \u003c 23.1.2)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","command-injection","nodejs"],"_cs_type":"threat","_cs_vendors":["Nx"],"content_html":"\u003cp\u003eThe Nx plugins \u003ccode\u003e@nx/maven\u003c/code\u003e and \u003ccode\u003e@nx/gradle\u003c/code\u003e are susceptible to OS command injection due to insecure interpolation of plugin options from \u003ccode\u003enx.json\u003c/code\u003e into shell commands. This vulnerability is triggered whenever an \u003ccode\u003enx\u003c/code\u003e command initiates project-graph analysis in a workspace containing a maliciously crafted \u003ccode\u003enx.json\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eFor \u003ccode\u003e@nx/maven\u003c/code\u003e, the injectable option is \u003ccode\u003etargetNamePrefix\u003c/code\u003e. For \u003ccode\u003e@nx/gradle\u003c/code\u003e, the vulnerability is more extensive, as arbitrary plugin option names and values are interpolated into command-line arguments. This flaw poses a risk to CI environments and local developers working within untrusted repositories. There is no evidence of active exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows arbitrary command execution under the privileges of the user running the \u003ccode\u003enx\u003c/code\u003e command. This represents a significant risk in automated CI pipelines that process pull requests or external repositories, as an attacker with write access to the \u003ccode\u003enx.json\u003c/code\u003e file can execute code without requiring access to build files themselves.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@nx/maven\u003c/code\u003e and \u003ccode\u003e@nx/gradle\u003c/code\u003e to version \u003cstrong\u003e22.7.9\u003c/strong\u003e (for the 22.x line) or \u003cstrong\u003e23.1.2\u003c/strong\u003e (for the 23.x line) or later.\u003c/li\u003e\n\u003cli\u003eUpgrading the plugin alone is insufficient; users must ensure the core \u003ccode\u003enx\u003c/code\u003e package is also upgraded to a compatible version as the fix depends on updated core code.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003enx migrate 23.1.2\u003c/code\u003e to update the project dependencies.\u003c/li\u003e\n\u003cli\u003eUntil updates are applied, restrict the execution of \u003ccode\u003enx\u003c/code\u003e commands to repositories from trusted sources only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T15:10:15Z","date_published":"2026-10-30T15:10:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nx-maven-gradle-rce/","summary":"The @nx/maven and @nx/gradle plugins contain an OS command injection vulnerability where unsafely interpolated nx.json configuration options lead to arbitrary command execution during project-graph analysis.","title":"Nx Maven and Gradle plugins: OS command injection (CVE-2026-119282)","url":"https://feed.craftedsignal.io/briefs/2026-10-nx-maven-gradle-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - @Nx/Maven (\u003e= 22.0.2, \u003c 22.7.9; \u003e= 23.0.0, \u003c 23.1.2)","version":"https://jsonfeed.org/version/1.1"}