CVE-2025-13437
Arbitrary node_modules Directory Deletion in Google zx
- State
- Published
- Severity
- 5.6 Medium
- Published
- Nov 20, 2025
- Updated
- Nov 20, 2025
- Reserved
- Nov 19, 2025
Description
When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.6 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U |
Weaknesses
- CWE-706 Use of Incorrectly-Resolved Name or Reference
Affected Products
| Product | Versions |
|---|---|
zxGoogle |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.