npm/nx: high
Nx: OS command injection via git revisions and remote refs
Action: Upgrade nx to 22.7.8 or later.
npm i nx@22.7.8npm i nx@23.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 14.0.0 | 22.7.8 | - |
| 23.0.0 | 23.1.1 | - |
Fixed versions
| 22.7.8 | 23.1.1 |
Sources
- osv: GHSA-w2vw-w76x-qr89
- https://github.com/nrwl/nx/security/advisories/GHSA-w2vw-w76x-qr89
- https://github.com/nrwl/nx/pull/36348
- https://github.com/nrwl/nx/pull/36379
- https://github.com/nrwl/nx/commit/11ab38573478172109bb5306cb30ca4af246caf0
- https://github.com/nrwl/nx/commit/4159295a037fdbd8e7f44a33a19d85ab3792415b
- https://github.com/nrwl/nx/commit/9ce184a04d2098a4797c8b0d6877ee079b751abf
- https://github.com/nrwl/nx/commit/c12850ce7b364db08e325c13541641d754db7123
- https://github.com/nrwl/nx/commit/cd9b3c068e17adc9c1722b35b9ca962b98542c20
- https://github.com/nrwl/nx/commit/cf996496bbad727362d48292b50fafc8c3665847
- https://github.com/nrwl/nx
- https://github.com/nrwl/nx/releases/tag/22.7.8
- https://github.com/nrwl/nx/releases/tag/23.1.1
published · modified · JSON