{"id":"EUVD-2025-198297","enisaUuid":"30de2b0a-c0a2-341f-9c4a-8af352fcfdda","description":"When zx is invoked with --prefer-local\u003d\u003cpath\u003e, the CLI creates a symlink named ./node_modules pointing to \u003cpath\u003e/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external \u003cpath\u003e/node_modules outside the current working directory.","datePublished":"Nov 20, 2025, 4:25:16 PM","dateUpdated":"Nov 20, 2025, 4:49:32 PM","baseScore":5.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U","references":"https://github.com/google/zx/issues/1348\n","aliases":"CVE-2025-13437\nGHSA-w87r-vg9q-crqm\n","assigner":"Google","epss":0.09,"enisaIdProduct":[{"id":"aa694b96-ddba-389d-b207-3dda9eda345a","product":{"name":"zx","vendor":{"name":"Google"}},"product_version":"8.8.4"}],"enisaIdVendor":[{"id":"880ecd17-b99f-31cf-a352-29a4d3c7ffb7","vendor":{"name":"Google"}}],"enisaIdVulnerability":[{"id":"a7e9fbfc-79c0-3af9-ad6a-1321b693f0ff","vulnerability":{"id":"GHSA-w87r-vg9q-crqm","description":"zx Uses Incorrectly-Resolved Name or Reference","datePublished":"Nov 20, 2025, 6:31:01 PM","dateUpdated":"Nov 21, 2025, 6:01:32 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-13437\nhttps://github.com/google/zx/issues/1348\nhttps://github.com/google/zx/pull/1349\nhttps://github.com/google/zx/pull/1355\nhttps://github.com/google/zx/commit/9ef6d3c9962c4ba01e3fb8075855570c192b4681\nhttps://github.com/google/zx/commit/a4d1bc2467f305f1c91d62506e215f307dc1fbeb\nhttps://github.com/google/zx\n","enisa_id":"EUVD-2025-198297\n","aliases":"GHSA-w87r-vg9q-crqm\nCVE-2025-13437\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d75727bf-9452-3134-bd03-9b4e6696a4de","vulnerability":{"id":"CVE-2025-13437","description":"When zx is invoked with --prefer-local\u003d\u003cpath\u003e, the CLI creates a symlink named ./node_modules pointing to \u003cpath\u003e/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external \u003cpath\u003e/node_modules outside the current working directory.","datePublished":"Nov 20, 2025, 4:25:16 PM","dateUpdated":"Nov 20, 2025, 4:49:32 PM","status":"PUBLISHED","baseScore":5.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U","references":"https://github.com/google/zx/issues/1348\n","enisa_id":"EUVD-2025-198297\n","assigner":"Google","epss":0.09,"dataProcessed":"Oct 31, 2026, 7:17:21 AM","vulnerabilityProduct":[{"id":"c08fb521-ee5f-3744-9bad-d70b3cdcd356","product":{"name":"zx","vendor":{"name":"Google"}},"product_version":"8.8.4"}],"vulnerabilityVendor":[{"id":"5c120955-b9a4-3759-9859-fbbdaab737d0","vendor":{"name":"Google"}}]}}],"enisaIdAdvisory":[]}