Google Zx vulnerabilities

2 CVEs affecting Google Zx, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-13437, published 2025-11-20.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-24959, published 2025-02-03. Low severity, CVSS 1.0. EPSS: 0.2% chance of exploitation in the next 30 days. zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command…
• CVE-2025-13437, published 2025-11-20. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the…