Zx (Google) - vulnerabilities (CVEs)

2 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-11-20. Vendor: Google.

CVEs of Zx

• CVE-2025-13437 - CVSS 5.6 (medium), 2025-11-20: When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in…
• CVE-2025-24959 - CVSS 1 (low), 2025-02-03: zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into…