Arbitrary Command Execution Vulnerability in zx Tool by Google

CVE-2025-24959

Summary

The zx tool, widely used for scripting, has a vulnerability that allows an attacker to manipulate environment variable values, potentially leading to arbitrary command execution. This occurs when applications process untrusted input through dotenv.stringify, making them susceptible to unexpected behavior if they rely on environment variables for critical security functions. Users are encouraged to upgrade to version 8.3.2 to address this issue. For those unable to upgrade, it is crucial to sanitize user-controlled values carefully, avoiding characters like double quotes, single quotes, and backticks, or to enforce strict validation on environment variables prior to use.

References