The Hook (The “What”) Can a single invisible character bypass a security sandbox ? I discovered a vulnerability in google/zx where a Carriage Return (\r) allows arbitrary code execution in Markdown files—right under the nose of code reviewers. What is zx ? In the world of DevOps, we often struggle with Bash (which is powerful but messy) and Node.js (which is clean but wordy). zx is a tool created by Google that marries the two.