Executive brief
zx is a command-line tool for running shell scripts in Node.js. When invoked with the --prefer-local flag, a logic error causes zx to delete an external node_modules directory outside the current working directory instead of cleaning up its own temporary symlink. This can result in unintended data loss and break builds or development projects.
Technical details
The vulnerability is a logic error in src/cli.ts where the linkNodeModules function creates a symlink ./node_modules pointing to an external target directory, but returns the target path instead of the symlink path. During cleanup, the rmrf function removes the path it receives, deleting the real external node_modules directory rather than unlinking the temporary symlink. The attack vector is local and requires user interaction (invoking zx with an attacker-controlled --prefer-local parameter). An attacker can cause deletion of arbitrary external node_modules directories, resulting in data loss or denial of service. Patches are available in versions 8.8.5 and later (fixed in commits 9ef6d3c and a4d1bc2).
Affected products
- Google zx before 8.8.5
Timeline
- 2025-10-03: disclosed: Issue opened on GitHub
- 2025-11-20: other: CVE-2025-13437 and GHSA-w87r-vg9q-crqm published
- 2025-11-21: patched: Patches available in version 8.8.5