CVE-2026-104859: Nx Monorepo Docker RCE Vulnerability

CVE-2026-104859 Overview

CVE-2026-104859 is a command injection vulnerability [CWE-78] in the @nx/docker package of Nx, a monorepo build system for TypeScript and polyglot codebases. The flaw affects versions 21.4.0 through 22.7.7 and 23.0.0 through 23.1.0. The release pipeline builds Docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl configuration values are interpolated into those strings and passed to /bin/sh -c. Attacker-controlled configuration executes arbitrary shell commands with the release job's privileges during nx release version or nx release publish.

Critical Impact
A malicious pull request or configuration change can execute shell commands in the release pipeline, exposing registry credentials and cloud tokens. Dry-run publishing does not prevent the vulnerable pre-check command from executing.

Affected Products

Nx @nx/docker versions 21.4.0 through 22.7.7
Nx @nx/docker versions 23.0.0 through 23.1.0
CI/CD pipelines invoking nx release version or nx release publish

Discovery Timeline

2026-10-02 - CVE-2026-104859 published to NVD
2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-104859

Vulnerability Analysis

The vulnerability resides in the @nx/docker release pipeline, specifically in packages/docker/src/executors/release-publish/release-publish.impl.ts and packages/docker/src/release/version-utils.ts. Both modules used Node.js child_process.exec and execSync, which spawn a shell to interpret the command string. Nx configuration values for release.docker.repositoryName and registryUrl were concatenated into these command strings without escaping.

An attacker who can modify Nx configuration — through a pull request, dependency update, or repository setting change — can inject shell metacharacters such as `, $(), ;, or &&. When the release job runs, /bin/sh -c evaluates the injected payload with the full privileges of the pipeline runner.

Root Cause

The root cause is the use of shell-interpreted process APIs (exec, execSync) combined with string interpolation of untrusted configuration values. No input validation or shell escaping was applied to repositoryName or registryUrl before building the command string.

Attack Vector

Attack paths include a pull request that modifies nx.json or a project.json to add shell metacharacters to the Docker release configuration. On merge or on PR workflow execution, the release pipeline interpolates the hostile value into a Docker command. Because the pre-check command executes even in dry-run mode, the attacker does not need to force a real publish. The injected commands run with access to CI secrets, registry credentials, and cloud identity tokens.

typescript

// Patch: packages/docker/src/executors/release-publish/release-publish.impl.ts
   workspaceRoot,
 } from '@nx/devkit';
 import { signalToCode } from '@nx/devkit/internal';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import type { DockerReleasePublishSchema } from './schema';
 import { existsSync, readFileSync } from 'fs';
 import { getDockerVersionPath } from '../../release/version-utils';

// Patch: packages/docker/src/release/version-utils.ts
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import { writeFileSync, mkdirSync } from 'fs';
 import { dirname, join } from 'path';
 import { prompt } from 'enquirer';

Source: nrwl/nx commit 6d60eed and commit b587441. The fix replaces exec/execSync with execFile/execFileSync, which spawn the Docker binary directly with argument arrays and no shell interpretation.

Detection Methods for CVE-2026-104859

Indicators of Compromise

Unexpected child processes spawned under /bin/sh -c during nx release invocations in CI runners.
Outbound network connections from CI jobs to hosts unrelated to the configured Docker registry.
Modifications to nx.json, project.json, or workspace configuration introducing shell metacharacters (`, $(, ;, &&, |) in repositoryName or registryUrl.
Unexplained reads of CI secret files such as ~/.docker/config.json, GITHUB_TOKEN, or cloud credential paths.

Detection Strategies

Scan pull requests for diffs to Nx release configuration that add shell metacharacters to Docker fields.
Audit CI runner process trees for sh -c invocations originating from node processes executing Nx release tasks.
Enable command-line auditing on build hosts and alert on child processes of nx release version and nx release publish.

Monitoring Recommendations

Log and alert on CI jobs that read credential files or environment variables not required by the release step.
Monitor registry authentication events for logins from unexpected source IPs following a release pipeline run.
Track installed @nx/docker versions across repositories and flag any pinned to vulnerable ranges.

How to Mitigate CVE-2026-104859

Immediate Actions Required

Upgrade @nx/docker to version 22.7.8 or 23.1.1 immediately.
Rotate any registry credentials, cloud tokens, and CI secrets accessible to release jobs that ran vulnerable versions.
Review recent pull requests touching nx.json or Docker release configuration for suspicious repositoryName or registryUrl values.
Require code review and branch protection on all files that influence release pipeline configuration.

Patch Information

The fix is published in Nx 22.7.8 and 23.1.1. The patch replaces child_process.exec and execSync with execFile and execFileSync, removing the shell from the command execution path. See the GitHub Security Advisory GHSA-6vc5-vf29-ffr2 and Pull Request #36505 for full details.

Workarounds

Restrict write access to Nx configuration files and require signed commits from trusted maintainers.
Run release pipelines in ephemeral, least-privilege runners with scoped, short-lived credentials.
Block pull-request-triggered workflows from accessing release secrets until maintainer approval.
Validate repositoryName and registryUrl against an allowlist regular expression before invoking Nx release commands.

bash

# Upgrade @nx/docker to a patched version
npm install --save-dev @nx/docker@22.7.8
# or for the 23.x line
npm install --save-dev @nx/docker@23.1.1

# Verify installed version
npm ls @nx/docker