{"metadata": {"vulnerability": "CVE-2026-119282", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-10-29T18:50:28.064Z", "date_only": false, "value": "2026-10-29T18:50:28.064Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119282", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T21:07:46.468Z", "date_only": false, "value": "2026-10-29T21:07:46.468Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T21:07:46.468Z", "date_only": false, "value": "2026-10-29T21:07:46.468Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-119282", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-29T21:18:34.227Z", "date_only": false, "value": "2026-10-29T21:18:34.227659Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117526279737285862", "record": "CVE-2026-119282", "field": "creation_timestamp", "uuid": "b8af4604-d994-4a1c-a9e1-4927de08bc10", "content": "CVE-2026-119282 Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119282https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9jhttps://github.com/nrwl/nx/pull/36626https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409https://github.com/nrwl/nx/releases/tag/22.7.9https://github.com/nrwl/nx/releases/tag/23.1.2#nrwl #nx #@nx #maven #gradle#CVE_2026_119282#bot", "url": "https://infosec.exchange/users/cve/statuses/117526279737285862"}, {"timestamp": "2026-10-29T22:17:00Z", "date_only": false, "value": "2026-10-29T22:17:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QM8W-VX34-5J9J", "record": "GHSA-QM8W-VX34-5J9J", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-29T22:17:00.887Z", "date_only": false, "value": "2026-10-29T22:17:00.887", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119282", "record": "FKIE_CVE-2026-119282", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T14:42:14Z", "date_only": false, "value": "2026-10-30T14:42:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QM8W-VX34-5J9J", "record": "GHSA-QM8W-VX34-5J9J", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T14:42:14Z", "date_only": false, "value": "2026-10-30T14:42:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QM8W-VX34-5J9J", "record": "GHSA-QM8W-VX34-5J9J", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T20:30:50Z", "date_only": false, "value": "2026-10-30T20:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/1b39ebf2c252c5f0ee1893bf7dd497d4", "record": "CVE-2026-119282", "field": "creation_timestamp", "uuid": "4329bd2b-ade8-4306-b203-43d9b13f1479", "content": "# CVE-2026-119282: CVE-2026-119282: OS Command Injection via Plugin Options in Nx (@nx/maven and @nx/gradle)\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-10-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-119282\n\n## Summary\nAn OS command injection and argument injection vulnerability exists in the Nx build system and its official Maven (@nx/maven) and Gradle (@nx/gradle) plugins. When constructing the project dependency graph, the plugins invoke underlying Java build wrappers via subshells while interpolating unsanitized plugin options directly from nx.json into the command arguments. An attacker who supplies a crafted nx.json file via a repository or pull request can execute arbitrary shell commands with the privileges of the user or CI/CD runner invoking any Nx command that computes the project graph.\n\n## TL;DR\nNx versions prior to 22.7.9 and 23.1.2 pass unvalidated configuration options from nx.json into child process executions with shell: true in @nx/maven and @nx/gradle. Running Nx commands in an untrusted repository or pull request allows arbitrary OS command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Class**: OS Command Injection (CWE-78) / Argument Injection (CWE-88)\n- **CVSS v4.0 Score**: 7.3 HIGH (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n- **Attack Vector**: Local via untrusted nx.json in repository or pull request\n- **Affected Components**: nx, @nx/maven, @nx/gradle (>= 21.0.0, < 22.7.9 and >= 23.0.0, < 23.1.2)\n- **Patched Versions**: 22.7.9 and 23.1.2\n- **EPSS Score**: 0.14% (3.38th percentile)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- nx\n- @nx/maven\n- @nx/gradle\n- **nx**: >= 21.0.0, < 22.7.9 (Fixed in: `22.7.9`)\n- **nx**: >= 23.0.0, < 23.1.2 (Fixed in: `23.1.2`)\n- **@nx/maven**: >= 21.0.0, < 22.7.9 (Fixed in: `22.7.9`)\n- **@nx/maven**: >= 23.0.0, < 23.1.2 (Fixed in: `23.1.2`)\n- **@nx/gradle**: >= 21.0.0, < 22.7.9 (Fixed in: `22.7.9`)\n- **@nx/gradle**: >= 23.0.0, < 23.1.2 (Fixed in: `23.1.2`)\n\n## Mitigation\n\n- Upgrade both the core nx package and any installed @nx/maven or @nx/gradle plugins to matched release versions 22.7.9 or 23.1.2.\n- Enforce strict code review requirements on nx.json using repository CODEOWNERS rules, treating it with the same sensitivity as CI workflow definitions and build scripts.\n- Isolate CI/CD execution on untrusted pull requests so that nx commands do not run with access to production secrets or write permissions before human review.\n\n**Remediation Steps:**\n1. Identify whether @nx/maven or @nx/gradle is installed in package.json or configured in nx.json.\n2. Run 'nx migrate 22.7.9' (for 22.x workspaces) or 'nx migrate 23.1.2' (for 23.x workspaces) to update package.json dependencies.\n3. Install the updated packages using your package manager (npm install, yarn, or pnpm install).\n4. Verify that node_modules/nx, node_modules/@nx/devkit, node_modules/@nx/maven, and node_modules/@nx/gradle all resolve to version 22.7.9 or 23.1.2+.\n\n## References\n\n- [GitHub Security Advisory GHSA-qm8w-vx34-5j9j](https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j)\n- [NVD - CVE-2026-119282 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-119282)\n- [CVE.org Record: CVE-2026-119282](https://www.cve.org/CVERecord?id=CVE-2026-119282)\n- [CVEListV5 Official JSON Record for CVE-2026-119282](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119282.json)\n- [GitHub Pull Request #36626 - Fix Command Injection in Maven and Gradle Plugins](https://github.com/nrwl/nx/pull/36626)\n- [Fix Commit 02c5d59e8dbbbe30963c0181c6a22cd8c1190a25](https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25)\n- [Fix Commit 60196b7cfcffcada35b6b90e53bf1a78d049b548](https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548)\n- [Fix Commit c227f4780b054c512965c73aa480a48f9f781409](https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409)\n- [Nx Release 22.7.9](https://github.com/nrwl/nx/releases/tag/22.7.9)\n- [Nx Release 23.1.2](https://github.com/nrwl/nx/releases/tag/23.1.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-119282) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/1b39ebf2c252c5f0ee1893bf7dd497d4"}, {"timestamp": "2026-11-03T16:48:35.280Z", "date_only": false, "value": "2026-11-03T16:48:35.280950Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119282", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-03T16:48:35.280Z", "date_only": false, "value": "2026-11-03T16:48:35.280950Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119282", "record": "FKIE_CVE-2026-119282", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-03T16:50:52.627Z", "date_only": false, "value": "2026-11-03T16:50:52.627Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119282", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-03T16:50:52.627Z", "date_only": false, "value": "2026-11-03T16:50:52.627Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119282", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-03T17:18:05.677Z", "date_only": false, "value": "2026-11-03T17:18:05.677", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119282", "record": "FKIE_CVE-2026-119282", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T10:18:02.900Z", "anchors": {"origin": {"timestamp": "2026-10-29T21:07:46.468Z", "date_only": false, "value": "2026-10-29T21:07:46.468Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-29T21:07:46.468Z", "date_only": false, "value": "2026-10-29T21:07:46.468Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 565816.432293, "hours": 157.17123119250002, "days": 6.548801299687501, "min_seconds": 565816.432293, "max_seconds": 565816.432293, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-29T21:07:46.468Z", "date_only": false, "value": "2026-10-29T21:07:46.468Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119282", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T10:18:02.900Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}