Homepage

org.webjars.npm:nx@15.9.7

  • latest version

    15.9.7

  • first published

    10 months ago

  • latest version published

    10 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:nx package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Arbitrary Argument Injection

    org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

    Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized git revision arguments passed to shell-interpolated execSync calls in getMergeBase (file-utils.ts), finishMigrationProcess, and undoMigration (migrate-ui-api.ts). Attacker-controlled values - sourced from defaultBase/affected.defaultBase in nx.json, the NX_BASE/NX_HEAD environment variables, the --base/--head CLI flags, or git refs stored in migrations.json - are interpolated directly into shell command strings. Because the shell evaluates command substitution (e.g. $(...) or backtick expressions) inside double-quoted strings before git receives any argument, an attacker who can control these values can achieve arbitrary command execution. The affected entry points include nx affected, nx show projects --affected, nx graph --affected, nx format, nx release plan, and the migrate UI API.

    How to fix Arbitrary Argument Injection?

    Upgrade org.webjars.npm:nx to version 22.7.8, 23.1.1 or higher.

    [14.0.0,22.7.8)[23.0.0,23.1.1)
    • H
    Access Control Bypass

    org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

    Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolated plugin workers. Socket directories and files are created under the ambient umask with no explicit permissions, and plugin worker sockets are placed directly in the shared system temp root (os.tmpdir()). This allows a local attacker sharing the same host to connect to or replace these sockets, enabling interception or manipulation of inter-process communication between the daemon and its clients with full read, write, and availability impact on the affected process.

    How to fix Access Control Bypass?

    Upgrade org.webjars.npm:nx to version 22.7.9, 23.1.2 or higher.

    [14.6.0,22.7.9)[23.0.0,23.1.2)
    • M
    Directory Traversal

    org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.

    Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the nx-migrations.migrations field from a package manifest without validating it. An attacker who controls a package manifest can supply an absolute path or a path containing ../ sequences as the migrations value, causing consumers to join that value onto a directory and use the result as a write destination outside the intended package boundary.

    How to fix Directory Traversal?

    Upgrade org.webjars.npm:nx to version 22.7.10, 23.2.1 or higher.

    [13.10.0,22.7.10)[23.0.0,23.2.1)
    Go back to all versions of this package