CyberRota Analysis
AI-GeneratedThe vulnerability affects the Nx monorepo solution for TypeScript and polyglot codebases, specifically in versions 21.4.0 to 22.7.8 and 23.0.0 to 23.1.1, where shell command strings constructed during Docker operations can execute arbitrary commands due to improper handling of untrusted configuration values. This can lead to unauthorized command execution with the privileges of the release job, potentially exposing sensitive registry credentials or cloud tokens. Organizations using affected Nx versions, particularly those with automated Docker workflows, should prioritize updating to versions 22.7.8 or 23.1.1 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl configuration values are interpolated into those strings and passed to /bin/sh -c, allowing shell syntax in untrusted Nx configuration to execute during nx release version or nx release publish. A pull request or repository configuration change can therefore execute commands with the release job's privileges and expose registry credentials or cloud tokens, and dry-run publishing does not prevent the vulnerable pre-check command from executing. This issue is fixed in versions 22.7.8 and 23.1.1.