CVE-2026-104859
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds shell command strings from configuration values, which are executed via /bin/sh -c. This allows shell syntax in untrusted Nx configuration to execute during release operations, potentially exposing registry credentials or cloud tokens.
Risk Assessment
An attacker can exploit malicious repository configuration to execute commands with release job privileges, leading to credential theft and system compromise.
Recommendation
Upgrade Nx to version 22.7.8 or 23.1.1 which fix the issue. Additionally, restrict trust in repository configurations and apply least privilege principles.
Other vulnerabilities in Nx
See all- CVE-2026-104854High
Nx from 14.6.0 until 22.7.9 and 23.1.2 creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only permissions. Another unprivileged local account can connect to a running socket because the transport performs no authentication. The daemon's PROCESS_IN_BACKGROUND request can execute code as the account running Nx. Fixed in versions 22.7.9 and 23.1.2.
- CVE-2026-104853Medium
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile dependency can supply .. segments or an absolute path, causing the migration archive to write attacker-controlled bytes outside the temporary directory or truncate an existing writable file.
- CVE-2026-71476High
Vulnerability in Nx (versions 20.8.0 to 22.7.7 and 23.0.2) in the self-hosted HTTP remote cache. A malicious cache server can return a crafted tar archive that writes files outside the cache directory, potentially leading to remote code execution.
Original NVD description (English source)
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl configuration values are interpolated into those strings and passed to /bin/sh -c, allowing shell syntax in untrusted Nx configuration to execute during nx release version or nx release publish. A pull request or repository configuration change can therefore execute commands with the release job's privileges and expose registry credentials or cloud tokens, and dry-run publishing does not prevent the vulnerable pre-check command from executing. This issue is fixed in versions 22.7.8 and 23.1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS