AIKIDO-2025-10655

TL;DR

Affected versions of this package are vulnerable to a command injection issue in the kill() function of the zx library on Windows, where the pid parameter is unsafely interpolated into a shell command via child_process.exec() without validation, allowing attackers controlling the input to execute arbitrary commands. An attacker can exploit this by injecting shell metacharacters into the pid argument, as demonstrated in the PoC where supplying '1234 & calc.exe' launches the calculator, proving remote code execution that could lead to full system compromise.