@nx/maven and @nx/gradle have OS command injection via nx.json plugin options

Summary @nx/maven and @nx/gradle spawn their project-graph analyzers through a shell and interpolate plugin options read from nx.json straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any nx command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits nx.json, runs the injected command with their own privileges. Severity A victim who runs an ordinary nx command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write nx.json can already run code through the repository's build files (./mvnw, pom.xml, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where nx.json is writable but the build files are not. We have no evidence of exploitation in the wild. Affected & Patched Versions | Package | Vulnerable | Patched | | --- | --- | --- | | @nx/maven | >= 22.0.2, = 23.0.0, = 21.0.0, = 23.0.0, [!IMPORTANT] Workspaces that register neither @nx/maven nor @nx/gradle in nx.json are unaffected — the…

curl https://cve.zerocrew.in/api/cve/CVE-2026-119282