CVE-2025-24959
1 advisory.
npm/zx CVE-2025-24959: medium 5.2
ZX Allows Environment Variable Injection for dotenv API
Action: Upgrade zx to 8.3.2 or later.
npm i zx@8.3.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.3.1 | 8.3.2 | - |
Fixed versions
| 8.3.2 |
Sources
- osv: GHSA-qwp8-x4ff-5h87
- https://github.com/google/zx/security/advisories/GHSA-qwp8-x4ff-5h87
- https://nvd.nist.gov/vuln/detail/CVE-2025-24959
- https://github.com/google/zx/pull/1094
- https://github.com/google/zx/commit/5ba714d14ecf0555a74d4db96622840ac19839c5
- https://github.com/google/zx
- https://github.com/webpod/envapi/blob/v0.2.1/src/main/ts/envapi.ts#L74-L77
CVE-2025-24959 · published · modified · JSON