Left limbo: reviewed by GitHub after 49 days
GHSA-qm8w-vx34-5j9j
@nx/maven on npm · published in nrwl/nx
Facts
- Severity
- High · CVSS score 7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Affected versions (@nx/maven)
- >= 22.0.2, < 22.7.9As entered by the maintainer. Not reviewed.
- Fixed in (@nx/maven)
- 22.7.9
- Affected versions (@nx/maven)
- >= 23.0.0, < 23.1.2As entered by the maintainer. Not reviewed.
- Fixed in (@nx/maven)
- 23.1.2
- Affected versions (@nx/gradle)
- >= 21.0.0, < 22.7.9As entered by the maintainer. Not reviewed.
- Fixed in (@nx/gradle)
- 22.7.9
- Affected versions (@nx/gradle)
- >= 23.0.0, < 23.1.2As entered by the maintainer. Not reviewed.
- Fixed in (@nx/gradle)
- 23.1.2
- CVE
- CVE-2026-119282 · published
- GitHub Advisory Database
- Reviewed
- OSV.dev
- Not checked
- Other CVEs pointing here
- None found in the CVE List
If you use @nx/maven >= 22.0.2, < 22.7.9
Upgrade to 22.7.9 or later. It’s in GitHub’s reviewed database now, so Dependabot, npm audit and OSV-Scanner can report it.
Timeline
2026-09-11 20:25 UTC
Published by the maintainers
Cites CVE-2026-119282
2026-10-28 08:42 UTC
First seen by Limbowatch
In limbo
2026-10-30 13:12 UTC
Change recorded
cites CVE-2026-119282 (was none)
2026-10-31 12:52 UTC
Reviewed by GitHub
Left limbo after 49 days