Symlink Vulnerability in zx CLI Tool by Google

CVE-2025-13437

What is CVE-2025-13437?

A security flaw in the Google zx CLI tool arises when executing commands with the --prefer-local= option. This action can create a symbolic link pointing to the node_modules directory of a specified path. However, a logic error in the code causes the cleanup routine to mistakenly delete the target directory instead of the symlink, potentially resulting in the loss of entire node_modules from an external directory. This vulnerability highlights the risks associated with improper file handling in CLI tools.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References