Vulnerability GHSA-qm8w-vx34-5j9j
Summary
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options
Details
Summary
@nx/maven and @nx/gradle spawn their project-graph analyzers through a shell and interpolate plugin options read from nx.json straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any nx command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits nx.json, runs the injected command with their own privileges.
Severity
A victim who runs an ordinary nx command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write nx.json can already run code through the repository's build files (./mvnw, pom.xml, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where nx.json is writable but the build files are not. We have no evidence of exploitation in the wild.
Affected & Patched Versions
| Package | Vulnerable | Patched |
|---|---|---|
@nx/maven |
>= 22.0.2, < 22.7.9; >= 23.0.0, < 23.1.2 |
22.7.9, 23.1.2 |
@nx/gradle |
>= 21.0.0, < 22.7.9; >= 23.0.0, < 23.1.2 |
22.7.9, 23.1.2 |
[!IMPORTANT] Workspaces that register neither
@nx/mavennor@nx/gradleinnx.jsonare unaffected — the vulnerable code only runs from those plugins' graph-construction paths, and no other Nx plugin shares this pattern.
Remediation
Upgrade to 22.7.9 (22.x line) or 23.1.2 (23.x line) or later:
nx migrate 23.1.2
Upgrade both nx and the affected plugin (@nx/maven and/or @nx/gradle). The plugin's fix depends on code that ships in the nx package, so bumping the plugin without a matching nx upgrade will not resolve it.
There is no configuration to change — upgrading is the whole fix. If you cannot upgrade yet, only run nx commands in repositories you trust, since a malicious nx.json can execute code on a vulnerable version.
Details
Both plugins spawn their analyzer through a shell and interpolate nx.json plugin options into the command, so those option values are shell source. For Maven the injectable value is the targetNamePrefix option; for Gradle it is broader, since every plugin option is mapped into a -P argument and arbitrary option names are accepted, making both the name and value of any option injectable.
Credits
- Arkadiusz Marta (RE:SOURCE) — Reporter
