Nx versions from 14.0.0 up to but not including 22.7.8, and from 23.0.0 up to but not including 23.1.1, contain a command injection vulnerability. This occurs because Nx builds shell command strings with untrusted git revision or branch name values interpolated directly, allowing an attacker controlling repository content to execute arbitrary commands on machines running Nx commands like 'nx affected' or 'nx import'. The vulnerability is particularly serious in CI environments where these commands run automatically. Fixed in versions 22.7.8 and 23.1.1.