GHSA-qm8w-vx34-5j9j @nx/maven and @nx/gradle have OS command injection via nx.json plugin options

• npm @nx/maven: >= 22.0.2, < 22.7.9 → fixed in 22.7.9 • npm @nx/maven: >= 23.0.0, < 23.1.2 → fixed in 23.1.2 • npm @nx/gradle: >= 21.0.0, < 22.7.9 → fixed in 22.7.9 • npm @nx/gradle: >= 23.0.0, < 23.1.2 → fixed in 23.1.2

Summary `@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any `nx` command that constructs the project graph. Anyone who clones a hostile repository, or who checks out a pull request that edits `nx.json`, runs the injected command with their own privileges. Severity A victim who runs an ordinary `nx` command in an attacker-supplied Maven or Gradle workspace gets code execution as themselves. In most such workspaces an attacker who can write `nx.json` can already run code through the repository's build files (`./mvnw`, `pom.xml`, and the Gradle equivalents), so the genuinely new exposure is narrow — for example CI building a fork's pull request where `nx.json` is writable but the build files are not. We have no evidence of exploitation in the wild. Affected & Patched Versions | Package | Vulnerable | Patched | | --- | --- | --- | | `@nx/maven` | `>= 22.0.2, = 23.0.0, = 21.0.0, = 23.0.0, [!IMPORTANT] > Workspaces that register neither `@nx/maven` nor `@nx/gradle` in `nx.json` are unaffected — the vulnerable code only runs from those plugins' graph-construction paths, and no other Nx plugin shares this pattern. Remediation Upgrade to 22.7.9 (22.x line) or 23.1.2 (23.x line) or later: ``` nx migrate 23.1.2 ``` Upgrade both `nx` and the affected plugin (`@nx/maven` and/or `@nx/gradle`). The plugin's fix depends on code that ships in the `nx` package, so bumping the plugin without a matching `nx` upgrade will not resolve it. There is no configuration to change — upgrading is the whole fix. If you cannot upgrade yet, only run `nx` commands in repositories you trust, since a malicious `nx.json` can execute code on a vulnerable version. Details Both plugins spawn their analyzer through a shell and interpolate `nx.json` plugin options into the command, so those option values are shell source. For Maven the injectable value is the `targetNamePrefix` option; for Gradle it is broader, since every plugin option is mapped into a `-P` argument and arbitrary option names are accepted, making both the name and value of any option injectable. Credits • Arkadiusz Marta (RE:SOURCE) — Reporter