# Nx: OS command injection via git revisions and remote refs

Nx interpolates git revisions and remote branch names into shell command strings, so a hostile repo's nx.json or branch name executes commands on CI runners.

- Payout: Research
- Severity: high
- Program: Nx
- Found by: arkmarta
- Disclosed: 2026-10-05
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-w2vw-w76x-qr89
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-w2vw-w76x-qr89
- Tags: area:oss domain:oss impact:internal-access impact:rce kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:command-injection

**Target:** Nx CLI git invocations (merge-base, diff, show, fetch, checkout, config)
**Root cause:** Nx builds git command lines as shell strings with untrusted revisions/refs interpolated; double quotes do not stop POSIX command substitution, so `$(...)` in a revision or branch name is executed by /bin/sh.
**Steps:**
1. Attacker sets `defaultBase` or `affected.defaultBase` in `nx.json` to a value containing `$(...)` command substitution, or sets `NX_BASE`/`NX_HEAD` env vars.
2. Victim runs `nx affected` or `nx show projects --affected`; Nx builds `git merge-base`/`git diff`/`git show <revision>:<path>` as a shell string.
3. Shell performs command substitution inside the double quotes and executes the injected command on the runner.
4. Alternatively, hostile remote advertises a branch name containing shell syntax; victim runs `nx import`, selects it, and the name is interpolated into `git fetch`/`checkout`/`config`.
**How found:** Code reading of Nx's git helper: noticed git invocations assembled as shell strings with revisions/refs interpolated, and that double-quoting does not prevent `$(...)` substitution.
**Exploitation:** A pull request that only modifies nx.json (or a cloned hostile repo) is enough: CI running `nx affected` executes attacker commands with the job's credentials. For `nx import`, the attacker controls advertised branch names and the chosen name is fed into shell-built git commands.
**Escalation:** CI runner execution yields whatever secrets/credentials the job holds; PR-only nx.json change bypasses code review of source files.
**Insight:** Double-quoted shell interpolation is not sanitization — POSIX still expands `$(...)` and backticks inside quotes; audit any tool that shells out to git with revision/ref values from config files or remote-advertised branch names, since those are attacker-controlled in PR and clone workflows.