CVE-2026-104859: @nx/docker OS Command Injection Vulnerability in Release Pipeline
Summary
CVE-2026-104859: @nx/docker: OS command injection in the @nx/docker release pipeline. Affects @nx/docker across 2 version ranges.
>= 21.4.0, < 22.7.8
>= 23.0.0, < 23.1.1
Fixed in 22.7.8 or 23.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @nx/docker package is a tool used within the Nx framework to facilitate Docker operations in a CI/CD pipeline. It allows developers to build, tag, and publish Docker images as part of their application deployment process. However, the package has a vulnerability that arises from how it constructs shell command strings, leading to potential command injection risks.
Vulnerability Detail
The vulnerability in @nx/docker stems from its release pipeline, which builds Docker command invocations as shell command strings. It interpolates user-defined values such as release.docker.repositoryName and registryUrl directly into these commands. If an attacker can manipulate these values, they can execute arbitrary commands during the execution of 'nx release version' and 'nx release publish'. This poses a significant risk, especially since CI environments often hold sensitive credentials, allowing attackers to gain unauthorized access to Docker registries and cloud services.
How To Fix
Latest published version: 24.0.0 as of 22 Oct 2026
npm install @nx/docker@24.0.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 21.4.0, < 22.7.822.7.8npm install @nx/docker@22.7.8 -
>= 23.0.0, < 23.1.123.1.1npm install @nx/docker@23.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you have previously run 'nx release version' with untrusted configuration, it is advisable to delete the generated Docker version file before your next publish to prevent executing any potentially malicious commands.
Conclusion
The @nx/docker package has a critical OS command injection vulnerability that can lead to unauthorized command execution in CI environments. It is essential to upgrade to the patched versions to mitigate this risk. Users should also be cautious about the configurations they use in their release pipelines.
See every vulnerability recorded for @nx/docker →
FAQ
The CVSS score for this vulnerability is 7.3, indicating a high severity level.
Versions >= 21.4.0 and < 22.7.8, as well as >= 23.0.0 and < 23.1.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As of now, there is no known evidence of exploitation of this vulnerability in the wild.
If an immediate upgrade is not possible, ensure that you do not run Docker releases against untrusted configurations and delete any generated Docker version files from previous runs.
