GHSA-W2VW-W76X-QR89
Vulnerability from github – Published: 2026-10-05 23:29 – Updated: 2026-10-05 23:29Summary
Nx core builds several git invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by /bin/sh instead. Two entry points are reachable by an attacker: affected commands, where defaultBase / affected.defaultBase from nx.json (and the NX_BASE / NX_HEAD environment variables) reach git merge-base and git diff; and nx import, where a branch name advertised by a remote repository reaches git fetch, git checkout, and git config. In both cases an attacker who controls a repository — or who opens a pull request against one — gets arbitrary command execution on the machine of anyone who runs an ordinary Nx command against it, including CI runners.
The affected path is the more serious of the two. nx affected and nx show projects --affected run constantly in CI, so a pull request that changes nothing but nx.json is enough to execute code on the runner with whatever credentials that job holds.
Severity
Exploitable by anyone who controls repository content — a fork's pull request, or a repository the victim clones — that the victim then runs an ordinary nx affected or nx import against; no access to the victim's machine is required. We have no evidence of exploitation in the wild.
Affected & Patched Versions
| Package | Vulnerable | Patched |
|---|---|---|
nx |
>= 14.0.0, < 22.7.8; >= 23.0.0, < 23.1.1 |
22.7.8, 23.1.1 |
Treat every version below the patched ones as affected.
Remediation
Upgrade to 22.7.8 (22.x line) or 23.1.1 (23.x line) or later:
nx migrate 23.1.1
The fix is a drop-in — no configuration changes are required. If you cannot upgrade, treat nx.json from untrusted sources as executable content, do not run affected commands against pull requests you have not reviewed, and do not run nx import against repositories you do not trust.
Details
affected commands
Nx computes the merge base and the changed-file set by building git merge-base and git diff command lines as strings and running them through a shell. The base and head revisions in those strings come from nx.json's defaultBase / affected.defaultBase or from the NX_BASE / NX_HEAD environment variables, and a related code path reads file contents with git show <revision>:<path> the same way. Because a shell parses the whole line, a revision value containing shell syntax is executed rather than passed to git.
The revisions are wrapped in double quotes, which looks protective but is not: POSIX shells still perform command substitution inside double quotes, so a value of $(…) runs without needing to break out of the quotes.
nx import
The GitRepository helper runs every git operation — fetch, checkout, reset, config, and others — by interpolating its arguments into a shell command string. The untrusted argument is a branch name: nx import lists the branches a remote advertises, offers them to the user to choose from, and feeds the chosen name back into those commands. A hostile repository controls the names of its own branches, so it controls the command that runs when one is selected.
Credits
- Arkadiusz Marta (RE:SOURCE) — Reporter
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nx"
},
"ranges": [
{
"events": [
{
"introduced": "14.0.0"
},
{
"fixed": "22.7.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "nx"
},
"ranges": [
{
"events": [
{
"introduced": "23.0.0"
},
{
"fixed": "23.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-88"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T23:29:06Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nNx core builds several `git` invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by `/bin/sh` instead. Two entry points are reachable by an attacker: `affected` commands, where `defaultBase` / `affected.defaultBase` from `nx.json` (and the `NX_BASE` / `NX_HEAD` environment variables) reach `git merge-base` and `git diff`; and `nx import`, where a branch name advertised by a remote repository reaches `git fetch`, `git checkout`, and `git config`. In both cases an attacker who controls a repository \u2014 or who opens a pull request against one \u2014 gets arbitrary command execution on the machine of anyone who runs an ordinary Nx command against it, including CI runners.\n\nThe `affected` path is the more serious of the two. `nx affected` and `nx show projects --affected` run constantly in CI, so a pull request that changes nothing but `nx.json` is enough to execute code on the runner with whatever credentials that job holds.\n\n## Severity\n\nExploitable by anyone who controls repository content \u2014 a fork\u0027s pull request, or a repository the victim clones \u2014 that the victim then runs an ordinary `nx affected` or `nx import` against; no access to the victim\u0027s machine is required. We have no evidence of exploitation in the wild.\n\n## Affected \u0026 Patched Versions\n\n| Package | Vulnerable | Patched |\n| --- | --- | --- |\n| `nx` | `\u003e= 14.0.0, \u003c 22.7.8`; `\u003e= 23.0.0, \u003c 23.1.1` | `22.7.8`, `23.1.1` |\n\nTreat every version below the patched ones as affected.\n\n## Remediation\n\nUpgrade to **22.7.8** (22.x line) or **23.1.1** (23.x line) or later:\n\n```\nnx migrate 23.1.1\n```\n\nThe fix is a drop-in \u2014 no configuration changes are required. If you cannot upgrade, treat `nx.json` from untrusted sources as executable content, do not run `affected` commands against pull requests you have not reviewed, and do not run `nx import` against repositories you do not trust.\n\n## Details\n\n### `affected` commands\n\nNx computes the merge base and the changed-file set by building `git merge-base` and `git diff` command lines as strings and running them through a shell. The base and head revisions in those strings come from `nx.json`\u0027s `defaultBase` / `affected.defaultBase` or from the `NX_BASE` / `NX_HEAD` environment variables, and a related code path reads file contents with `git show \u003crevision\u003e:\u003cpath\u003e` the same way. Because a shell parses the whole line, a revision value containing shell syntax is executed rather than passed to `git`.\n\nThe revisions are wrapped in double quotes, which looks protective but is not: POSIX shells still perform command substitution inside double quotes, so a value of `$(\u2026)` runs without needing to break out of the quotes.\n\n### `nx import`\n\nThe `GitRepository` helper runs every git operation \u2014 `fetch`, `checkout`, `reset`, `config`, and others \u2014 by interpolating its arguments into a shell command string. The untrusted argument is a branch name: `nx import` lists the branches a remote advertises, offers them to the user to choose from, and feeds the chosen name back into those commands. A hostile repository controls the names of its own branches, so it controls the command that runs when one is selected.\n\n\n## Credits\n\n- **Arkadiusz Marta** (RE:SOURCE) \u2014 Reporter",
"id": "GHSA-w2vw-w76x-qr89",
"modified": "2026-10-05T23:29:06Z",
"published": "2026-10-05T23:29:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/security/advisories/GHSA-w2vw-w76x-qr89"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/pull/36348"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/pull/36379"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/11ab38573478172109bb5306cb30ca4af246caf0"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/4159295a037fdbd8e7f44a33a19d85ab3792415b"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/9ce184a04d2098a4797c8b0d6877ee079b751abf"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/c12850ce7b364db08e325c13541641d754db7123"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/cd9b3c068e17adc9c1722b35b9ca962b98542c20"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/cf996496bbad727362d48292b50fafc8c3665847"
},
{
"type": "PACKAGE",
"url": "https://github.com/nrwl/nx"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/releases/tag/22.7.8"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/releases/tag/23.1.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Nx: OS command injection via git revisions and remote refs"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.