When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/google/zx/issues/1348 |
Configurations
No configuration.
History
20 Nov 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-20 17:15
Updated : 2025-11-21 15:13
NVD link : CVE-2025-13437
Mitre link : CVE-2025-13437
CVE.ORG link : CVE-2025-13437
JSON object : View
Products Affected
No product.
CWE
CWE-706
Use of Incorrectly-Resolved Name or Reference