Package vulnerability, severity high
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
Published , updated
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options. Source: GHSA-qm8w-vx34-5j9j (CVE-2026-119282).
What's affected
- @nx/maven (npm)>=22.0.2 <22.7.9
- @nx/maven (npm)>=23.0.0 <23.1.2
- @nx/gradle (npm)>=21.0.0 <22.7.9
- @nx/gradle (npm)>=23.0.0 <23.1.2
What to do
- Upgrade @nx/maven to 22.7.9 or later.
- Upgrade @nx/maven to 23.1.2 or later.
- Upgrade @nx/gradle to 22.7.9 or later.
- Upgrade @nx/gradle to 23.1.2 or later.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident ghsa-qm8w-vx34-5j9jReferences
- https://osv.dev/vulnerability/GHSA-qm8w-vx34-5j9j
- https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j
- https://nvd.nist.gov/vuln/detail/CVE-2026-119282
- https://github.com/nrwl/nx/pull/36626
- https://github.com/nrwl/nx/commit/02c5d59e8dbbbe30963c0181c6a22cd8c1190a25
- https://github.com/nrwl/nx/commit/60196b7cfcffcada35b6b90e53bf1a78d049b548
- https://github.com/nrwl/nx/commit/c227f4780b054c512965c73aa480a48f9f781409
- https://github.com/nrwl/nx
- https://github.com/nrwl/nx/releases/tag/22.7.9
- https://github.com/nrwl/nx/releases/tag/23.1.2
Notice ghsa-qm8w-vx34-5j9j, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.