https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 19:27:52 +0000 https://db.gcve.eu/vuln/brew-nx-ghsa-w2vw-w76x-qr89 <p><strong>Affected:</strong> Homebrew: nx</p> <p>## Summary</p> <p>Nx core builds several `git` invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by `/bin/sh` instead. Two entry points are reachable by an attacker: `affected` commands, where `defaultBase` / `affected.defaultBase` from `nx.json` (and the `NX_BASE` / `NX_HEAD` environment variables) reach `git merge-base` and `git diff`; and `nx import`, where a branch name advertised by a remote repository reaches `git fetch`, `git checkout`, and `git config`. In both cases an attacker who controls a repository — or who opens a pull request against one — gets arbitrary command execution on the machine of anyone who runs an ordinary Nx command against it, including CI runners.</p> <p>The `affected` path is the more serious of the two. `nx affected` and `nx show projects --affected` run constantly in CI, so a pull request that changes nothing but `nx.json` is enough to execute code on the runner with whatever credentials that job holds.</p> <p>## Severity</p> <p>Exploitable by anyone who controls repository content — a fork&#39;s pull request, or a repository the victim clones — that the victim then runs an ordinary `nx affected` or `nx import` against; no access to the victim&#39;s machine is required. We have no evidence of exploitation in the wild.</p> <p>## Affected &amp; Patched Versions</p> <p>| Package | Vulnerable | Patched | | --- | --- | --- | | `nx` | `&gt;= 14.0.0, &lt; 22.7.8`; `&gt;= 23.0.0, &lt; 23.1.1` | `22.7.8`, `23.1.1` |</p> <p>Tre…</p> <p><strong>Affected:</strong> Homebrew: nx</p> <p>## Summary</p> <p>Nx core builds several `git` invocations as shell command strings with untrusted values interpolated into them, so a value that should be a git revision or ref is parsed by `/bin/sh` instead. Two entry points are reachable by an attacker: `affected` commands, where `defaultBase` / `affected.defaultBase` from `nx.json` (and the `NX_BASE` / `NX_HEAD` environment variables) reach `git merge-base` and `git diff`; and `nx import`, where a branch name advertised by a remote repository reaches `git fetch`, `git checkout`, and `git config`. In both cases an attacker who controls a repository — or who opens a pull request against one — gets arbitrary command execution on the machine of anyone who runs an ordinary Nx command against it, including CI runners.</p> <p>The `affected` path is the more serious of the two. `nx affected` and `nx show projects --affected` run constantly in CI, so a pull request that changes nothing but `nx.json` is enough to execute code on the runner with whatever credentials that job holds.</p> <p>## Severity</p> <p>Exploitable by anyone who controls repository content — a fork&#39;s pull request, or a repository the victim clones — that the victim then runs an ordinary `nx affected` or `nx import` against; no access to the victim&#39;s machine is required. We have no evidence of exploitation in the wild.</p> <p>## Affected &amp; Patched Versions</p> <p>| Package | Vulnerable | Patched | | --- | --- | --- | | `nx` | `&gt;= 14.0.0, &lt; 22.7.8`; `&gt;= 23.0.0, &lt; 23.1.1` | `22.7.8`, `23.1.1` |</p> <p>Tre…</p> https://db.gcve.eu/vuln/brew-nx-ghsa-w2vw-w76x-qr89