Nx CVE-2026-119282 (GHSA-qm8w-vx34-5j9j): @nx/maven and @nx/gradle run nx.json plugin options through a shell, so a malicious nx.json executes commands. Which versions fix it, and why does it matter for CI on fork PRs?

What it is: In Nx monorepos, the @nx/maven and @nx/gradle plugins build the project graph by running their analyzers through a shell, inserting plugin options from nx.json directly into the command line. An option value containing shell syntax runs as a command whenever any nx command builds the project graph. Whoever clones a hostile repository, or CI that checks out a pull request editing nx.json, runs that command with their own permissions. Nx notes the new exposure is narrow, because whoever can edit a Maven/Gradle workspace can usually already run code through its build files; the main case is CI that builds fork PRs where nx.json is writable but build files aren't. Published October 30, 2026 (high); no known exploitation. Am I affected: - @nx/maven 22.0.2 up to 22.7.8 or 23.0.0 up to 23.1.1; @nx/gradle 21.0.0 up to 22.7.8 or 23.0.0 up to 23.1.1. - Only if nx.json registers @nx/maven or @nx/gradle as a plugin; workspaces that don't use those plugins are unaffected. - Check with npm ls @nx/maven @nx/gradle (or pnpm/yarn equivalents) and look at the plugins list in nx.json. Fix: 1. Upgrade to 22.7.9 or 23.1.2 or later (keep all @nx/* packages on the same version, e.g. with nx migrate), commit the lockfile and redeploy CI images. 2. Treat repository config as code: don't run nx (or any build tooling) on untrusted clones or fork pull requests with access to secrets. In GitHub Actions, run fork PR builds without secrets and with a read-only token, and avoid pull_request_target workflows that check out PR code. 3. Review nx.json changes in pull requests like build script changes. Verify: npm ls shows @nx/maven and @nx/gradle at a fixed version, and CI workflows for forks run without secrets. Sources: https://github.com/nrwl/nx/security/advisories/GHSA-qm8w-vx34-5j9j https://nvd.nist.gov/vuln/detail/CVE-2026-119282 https://github.com/nrwl/nx/pull/36626