Executive brief
ZX is a popular JavaScript library that simplifies shell scripting in Node.js. A flaw in its dotenv.stringify function allows attackers who control environment variable values to inject malicious variables into the process environment, potentially leading to arbitrary command execution or application malfunction in systems that rely on environment variables for security decisions.
Technical details
The vulnerability is an environment variable injection flaw (CWE-74) in the dotenv.stringify function of ZX version 8.3.1. An attacker with control over environment variable values passed to dotenv.stringify can inject unintended variables into process.env by exploiting insufficient input sanitization. The attack requires adjacent network access, low privileges, and user interaction, but can result in high availability impact or arbitrary command execution depending on how the application uses the injected variables. The vulnerability is patched in version 8.3.2; workarounds include sanitizing user inputs and avoiding special characters like quotes and backticks in environment variable values.
Affected products
- Google zx 8.3.1
Timeline
- 2025-02-03: disclosed: Advisory published
- 2025-02-03: patched: Fix available in version 8.3.2