Google zx 8.8.4 Working Directory src/cli.ts linkNodeModules name resolution

Summaryinfo

A vulnerability was found in Google zx 8.8.4. It has been rated as problematic. Affected by this issue is the function linkNodeModules of the file src/cli.ts of the component Working Directory Handler. Performing a manipulation results in name resolution. This vulnerability is identified as CVE-2025-13437. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Google zx 8.8.4. This affects the function linkNodeModules of the file src/cli.ts of the component Working Directory Handler. The manipulation with an unknown input leads to a name resolution vulnerability. CWE is classifying the issue as CWE-706. The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. This is going to have an impact on integrity, and availability. The summary by CVE is:

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.

The weakness was released by Ali Firas. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-13437 since 11/19/2025. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/21/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-198297). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Google

Name

• zx

Version

• 8.8.4

License

• free

Website

• Vendor: https://www.google.com/
• Product: https://github.com/google/zx/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion