CVE-2025-13437
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-20

Assigner: Google Inc.

Description
When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-20
Last Modified
2025-11-20
Generated
2026-06-16
AI Q&A
2025-11-20
EPSS Evaluated
2026-06-14
NVD
CVE-2025-13437
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
google zx 4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-706 The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs when the zx CLI is run with the --prefer-local=<path> option. The CLI creates a symbolic link named ./node_modules pointing to <path>/node_modules. Due to a logic error in the code, the cleanup function mistakenly deletes the target directory (<path>/node_modules) instead of just the symlink. This means zx can delete an external node_modules directory outside the current working directory unintentionally.

Impact Analysis

The vulnerability can lead to unintended deletion of important directories outside the current working directory, specifically the external <path>/node_modules directory. This can cause loss of dependencies, disruption of development environments, and potential data loss.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart