{"action":"Upgrade @nx/docker to 22.7.8 or later.","affected":[{"fixed":"22.7.8","introduced":"21.4.0"},{"fixed":"23.1.1","introduced":"23.0.0"}],"component":"@nx/docker","cve_ids":["CVE-2026-104859"],"ecosystem":"npm","epss":0.00148,"exploited":false,"fixed_versions":["22.7.8","23.1.1"],"ghsa_id":"GHSA-6vc5-vf29-ffr2","id":"tcs_01M5KF80NPSD5AQ90H5RDGW2J3","modified_at":"2026-10-05T23:45:08.226593535Z","published_at":"2026-10-05T23:29:13Z","references":["https://osv.dev/vulnerability/GHSA-6vc5-vf29-ffr2","https://github.com/nrwl/nx/security/advisories/GHSA-6vc5-vf29-ffr2","https://nvd.nist.gov/vuln/detail/CVE-2026-104859","https://github.com/nrwl/nx/pull/36505","https://github.com/nrwl/nx/commit/6d60eed061f050e0d5af509a1f5a07c707f09865","https://github.com/nrwl/nx/commit/b587441fd8da28c5db37edb0826554e0060dc81b","https://github.com/nrwl/nx"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-6vc5-vf29-ffr2","url":"https://osv.dev/vulnerability/GHSA-6vc5-vf29-ffr2"},{"source":"nvd","source_id":"CVE-2026-104859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104859"}],"summary":"@nx/docker: OS command injection in the @nx/docker release pipeline"}