AIKIDO-2026-373135
nx is vulnerable to Command Injection
48
Medium Risk
This Affects:
nxTL;DR
The nx CLI builds git commands as shell strings and interpolates untrusted revision and branch values into them before execution. Affected base and head revisions taken from nx.json, the NX_BASE and NX_HEAD environment variables, and --base and --head flags, git refs read back from a workspace migrations.json, and remote branch names used by nx import all reach a shell without escaping. Shell metacharacters such as command substitution in those values execute arbitrary commands on the developer or CI machine when commands like nx affected, nx graph --affected, nx format, nx release plan, the migrate UI, or nx import run. The fix executes git through argument arrays instead of a shell and validates git revisions and SHAs before use.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run Nx commands such as affected, format, release plan, migrate, or import against workspace configuration, git revisions, or a remote repository whose contents can be influenced by an untrusted source.
Background info
nx is vulnerable to Command Injection in versions 13.10.0 - 22.7.7 and 23.0.0 - 23.1.0.
How to fix this
Upgrade the nx library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant