CVE-2026-119282: @nx/maven and @nx/gradle have OS command injection via nx.json plugin options

Severity: high. ## Summary `@nx/maven` and `@nx/gradle` spawn their project-graph analyzers through a shell and interpolate plugin options read from `nx.json` straight into the command line. Because a shell parses the whole line, an option value containing shell syntax is executed as a command by any `nx` command

Читать первоисточник →