P5Verified

@nx/docker: OS command injection in the @nx/docker release pipeline

CVE-2026-104859 affects @nx/docker. EPSS 0.0015 (percentile 0.03588), scored 2026-10-04. Affected range: >= 21.4.0, < 22.7.8. Fixed version: 22.7.8. Affected range: >= 23.0.0, < 23.1.1. Fixed version: 23.1.1.

Affected technology

nx · >= 21.4.0, < 22.7.8, >= 23.0.0, < 23.1.1
nrwl

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 2026-10-05 23:10:38.851912+00:00

CVE: CVE-2026-104859
CWE: CWE-78
Product: @nx/docker
CCR priority: 0.0 /100 (P5)
EPSS: 0.0015 · percentile 0.03588 · 2026-10-04
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-05 23:09:08.830529+00:00 UTC
GitHub Advisory Database · Source record · observed 2026-10-06 00:14:20.210633+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-104859.html