GitHub Advisoryadvisory · npm

GHSA-w87r-vg9q-crqm zx Uses Incorrectly-Resolved Name or Reference

MEDIUM Published 2025-11-20 Modified 2025-11-21 Official page ↗
Aliases
CVE-2025-13437
Ecosystem
npm
Packages
zx
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U
Weaknesses
CWE-706
Reviewed
2025-11-21

Affected packages

• npm zx: < 8.8.5 → fixed in 8.8.5

Description

When zx is invoked with --prefer-local=, the CLI creates a symlink named ./node_modules pointing to /node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external /node_modules outside the current working directory.

Related

Alias · CVE (1)

  • CVE-2025-13437 When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. vulnerability

Weakness · CWE (1)

  • CWE-706 Use of Incorrectly-Resolved Name or Reference weakness

References