@nx/maven@23.1.0-rc.3

@nx/maven is a Nx plugin for Maven integration

Affected versions of this package are vulnerable to Command Injection via maven-analyzer.ts and related spawn utilities in @nx/maven and @nx/gradle, which invoke child processes with shell: true and interpolate values read from nx.json directly into the command line. An attacker who controls nx.json (for example, by contributing to a repository) can inject arbitrary shell commands into plugin option values such as targetNamePrefix, causing those commands to execute whenever any nx command triggers project graph construction. In the Gradle case, the open index signature of GradlePluginOptions also makes option keys injectable, broadening the attack surface.

Upgrade @nx/maven to version 22.7.9, 23.1.2 or higher.