PT-2025-47601 · Zx · Zx

Ali Firas · Published 2025-11-20 · Updated 2025-11-24 · CVE-2025-13437

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions zx (affected versions not specified)

Description A flaw exists in zx where, when invoked with the --prefer-local option pointing to a specific path, the command-line interface creates a symbolic link named ./node modules to the specified path’s node modules directory. A logic error within the src/cli.ts file, specifically in the linkNodeModules and cleanup functions, causes the function to return the target path instead of the symlink path. Subsequently, the cleanup routine inadvertently deletes the target directory outside of the current working directory. This can lead to the deletion of external node modules directories. The vulnerable functions are linkNodeModules() and cleanup(). The vulnerable parameter is <path>.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2025-13437

GHSA-W87R-VG9Q-CRQM

Affected Products

Zx

References · 6

• https://osv.dev/vulnerability/CVE-2025-13437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13437 · Security Note
• https://github.com/google/zx/issues/1348 · Note
• https://reddit.com/r/VulnMatter/comments/1p5nvy1/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post
• https://twitter.com/CVEnew/status/1991550824095322155 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p5s47k/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post