Skip to content
OpenAdvisories

Package · npm

zx

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.6
    CVE-2025-13437

    Arbitrary node_modules Directory Deletion in Google zx

    When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink p…

    Google zx zx npm
  • Low 1.0
    CVE-2025-24959

    Environment Variable Injection for dotenv API in zx

    zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command execution or unexpected behavior in applications that rely on…

    Google zx zx node-zx Ubuntu npm