nrwl/nx

The security-sensitive boundaries are workspace-supplied executable code, shell commands, daemon messages, native module loading, and replayed cache artifacts. Several inspected paths contain explicit containment and ownership safeguards. The observations below distinguish implemented behavior from hypotheses; they are not confirmed vulnerabilities. One inspected test contains an ineffective assertion, and native/testing module boundaries require particular care.

• run-commands launches command strings with shell:true and inherited stdin; calculateCwd accepts absolute paths, and processEnv combines process/local environments with executor overrides. Workspace task configuration therefore controls execution beyond the repository directory.
  packages/nx/src/executors/run-commands/running-tasks.ts#L432-454packages/nx/src/executors/run-commands/running-tasks.ts#L705-748
• Generator dry-run still invokes the plugin implementation before skipping flushChanges and the returned callback; FsTree normalization and flushChanges use joined paths. Dry-run is a host-write preview, not an execution sandbox for arbitrary generator code.
  packages/nx/src/command-line/generate/generate.ts#L401-428packages/nx/src/generators/tree.ts#L376-394packages/nx/src/generators/tree.ts#L438-450
• The self-hosted HTTP cache reads a bearer token and server URL from environment variables and explicitly accepts invalid certificates when NODE_TLS_REJECT_UNAUTHORIZED=0; the TypeScript factory emits an insecure-TLS warning for that setting.
  packages/nx/src/native/cache/http_remote_cache.rs#L26-65packages/nx/src/tasks-runner/cache.ts#L372-388
• Hypothesis: large remote artifacts could create memory or disk pressure because retrieval buffers the full response and extraction accumulates metadata content before returning. The inspected path enforces archive containment, but resource-exhaustion behavior was not measured. (inferred)
  packages/nx/src/native/cache/http_remote_cache.rs#L190-223packages/nx/src/native/cache/http_remote_cache.rs#L236-275
• Shared artifact/database paths are a replay trust boundary: establishUserRoot checks private owned directories and probes both leaves with exclusive random files; native cache output normalization rejects declared paths outside the workspace.
  packages/nx/src/utils/cache-directory.ts#L135-165packages/nx/src/utils/cache-directory.ts#L179-196packages/nx/src/native/cache/cache.rs#L777-799
• Daemon input parsing checks workspace identity for recognized messages and closes malformed streams; plugin worker startup refusals can instead move plugins into the main process, with an explicit warning that isolation-dependent plugins may misbehave.
  packages/nx/src/daemon/server/server.ts#L216-232packages/nx/src/daemon/server/server.ts#L282-310packages/nx/src/project-graph/plugins/get-plugins.ts#L105-152
• Native loading hooks Module._load and caches binaries outside their installed location; Vitest configuration explicitly warns that native bindings are unsafe across worker threads and duplicate binding heaps can kill a worker. Preserve loader identity and process-pool assumptions together.
  packages/nx/src/native/index.js#L84-118packages/nx/vitest.config.mts#L35-58
• The cache-size test for multiple decimal points references .toThrow without calling it, so that assertion does not verify rejection; the neighboring invalid-number test correctly calls .toThrow(). This is a source-observed test defect, not an observed runtime failure.
  packages/nx/src/tasks-runner/cache.spec.ts#L36-46