CVE-2026-119282
Description
A flaw was found in Nx. The project-graph analyzers in the Maven and Gradle plugins interpolate workspace configuration options directly into shell command arguments without adequate sanitization. An attacker who convinces a user to run Nx within a malicious repository or pull request can exploit this vulnerability to execute arbitrary commands with the privileges of the executing user.
Statement
This vulnerability is rated as Important severity for Red Hat environments because successful exploitation enables arbitrary command execution with the privileges of the local user, though it requires convincing a user to inspect or process an untrusted repository. The impact is confined to workflows utilizing the optional Maven or Gradle graph-analyzer plugins within workspace settings. Workspaces that do not configure these integrations are unaffected by this command injection path.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
