CVE-2026-104859

Name of the Vulnerable Software and Affected Versions Nx versions 21.4.0 through 22.7.7 Nx versions 23.0.0 through 23.1.0

Description The @nx/docker release pipeline constructs docker tag, image lookup, and docker push invocations as shell command strings. The configuration values release.docker.repositoryName and registryUrl are interpolated into these strings and passed to /bin/sh -c. This allows shell syntax within untrusted Nx configurations to execute during nx release version or nx release publish operations. Consequently, a pull request or repository configuration change could execute commands with the privileges of the release job, potentially exposing registry credentials or cloud tokens. Dry-run publishing does not prevent the execution of the vulnerable pre-check command.

Recommendations Update to version 22.7.8. Update to version 23.1.1.