AIKIDO-2026-373135

TL;DR

The nx CLI builds git commands as shell strings and interpolates untrusted revision and branch values into them before execution. Affected base and head revisions taken from nx.json, the NX_BASE and NX_HEAD environment variables, and --base and --head flags, git refs read back from a workspace migrations.json, and remote branch names used by nx import all reach a shell without escaping. Shell metacharacters such as command substitution in those values execute arbitrary commands on the developer or CI machine when commands like nx affected, nx graph --affected, nx format, nx release plan, the migrate UI, or nx import run. The fix executes git through argument arrays instead of a shell and validates git revisions and SHAs before use.