Vulnerabilidades de Google zx (CVE)

Registros CVE publicados para Google zx, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

2 resultados
5.6Media
CVE-2025-13437

Arbitrary node_modules Directory Deletion in Google zx

Google zx

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink p…

1.0Baja
CVE-2025-24959

Environment Variable Injection for dotenv API in zx

google zx

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command execution or unexpected behavior in applications that rely on…