CVE-2025-13437

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.

• CWE-706

• https://github.com/google/zx/issues/1348

Published

Nov 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13431The SlimStat Analytics plugin for WordPress is vulnerable to…6.5
• CVE-2025-13432Terraform state versions can be created by a user with speci…4.3
• CVE-2025-13433A security flaw has been discovered in Muse Group MuseHub 2.…7.3
• CVE-2025-13434A weakness has been identified in jameschz Hush Framework 2.…7.5
• CVE-2025-13435A security vulnerability has been detected in Dreampie Resty…8.1
• CVE-2025-13436GitLab has remediated an issue in GitLab CE/EE affecting all…6.5
• CVE-2025-13438The Page Title, Description & Open Graph Updater plugin for …4.3
• CVE-2025-13439The Fancy Product Designer plugin for WordPress is vulnerabl…5.9
• CVE-2025-13440The Premmerce Wishlist for WooCommerce plugin for WordPress …5.3
• CVE-2025-13441The Hide Category by User Role for WooCommerce plugin for Wo…5.3
• CVE-2025-13442A security vulnerability has been detected in UTT 进取 750W up…9.8
• CVE-2025-13443A vulnerability was detected in macrozheng mall up to 1.0.3.…6.5