Arbitrary Argument Injection Affecting nx package, versions >=14.0.0 <22.7.8>=23.0.0 <23.1.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Argument Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-NX-20537053
- published6 Oct 2026
- disclosed5 Oct 2026
- creditArkadiusz Marta
Introduced: 5 Oct 2026
New CVE NOT AVAILABLE CWE-78 (opens in a new tab)How to fix?
Upgrade nx to version 22.7.8, 23.1.1 or higher.
Overview
nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.
Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized git revision arguments passed to shell-interpolated execSync calls in getMergeBase (file-utils.ts), finishMigrationProcess, and undoMigration (migrate-ui-api.ts). Attacker-controlled values - sourced from defaultBase/affected.defaultBase in nx.json, the NX_BASE/NX_HEAD environment variables, the --base/--head CLI flags, or git refs stored in migrations.json - are interpolated directly into shell command strings. Because the shell evaluates command substitution (e.g. $(...) or backtick expressions) inside double-quoted strings before git receives any argument, an attacker who can control these values can achieve arbitrary command execution. The affected entry points include nx affected, nx show projects --affected, nx graph --affected, nx format, nx release plan, and the migrate UI API.