{"id":"EUVD-2025-198297","revision":"2986ea5abb054d839d2030e273e59f4f","records":[{"revision":"2986ea5abb054d839d2030e273e59f4f","observedAt":"2026-11-07T01:27:50.752+00:00","statement":{"source":"euvd","id":"EUVD-2025-198297","aliases":["CVE-2025-13437","GHSA-w87r-vg9q-crqm"],"title":"When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of t…","description":"When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:U","score":5.6,"severity":null}],"references":["https://github.com/google/zx/issues/1348"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198297","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 20, 2025, 4:25:16 PM","dateUpdated":"Nov 20, 2025, 4:49:32 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-198297","identifiers":["EUVD-2025-198297","CVE-2025-13437","GHSA-w87r-vg9q-crqm"]},"retained":false,"historicalAffected":[]}],"coverage":[]}