Disclosure summary
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl configuration values are interpolated into those strings and passed to /bin/sh -c, allowing shell syntax in untrusted Nx configuration to execute during nx release version or nx release publish. A pull request or repository configuration change can therefore execute commands with the release job's privileges and expose registry credentials or cloud tokens, and dry-run publishing does not prevent the vulnerable pre-check command from executing. This issue is fixed in versions 22.7.8 and 23.1.1.
Source-reported weakness categories
CWE-78
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-6vc5-vf29-ffr2
Open original source · Updated Oct 05, 2026
@nx/docker: OS command injection in the @nx/docker release pipeline
Source severity: HIGH / 7.3
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | @nx/docker | >= 21.4.0, < 22.7.8 | 22.7.8 |
| npm | @nx/docker | >= 23.0.0, < 23.1.1 | 23.1.1 |
NIST National Vulnerability Database · NVD-CVE-2026-104859
Open original source · Updated Oct 05, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
PUBLISHED 2026-10-02T14:17:02-04:00
MODIFIED 2026-10-05T17:16:32-04:00
INGESTED 2026-10-06T11:45:30-04:00