Symlink Vulnerability in zx CLI Tool by Google

CVE-2025-13437

What is CVE-2025-13437?

A security flaw in the Google zx CLI tool arises when executing commands with the --prefer-local= option. This action can create a symbolic link pointing to the node_modules directory of a specified path. However, a logic error in the code causes the cleanup routine to mistakenly delete the target directory instead of the symlink, potentially resulting in the loss of entire node_modules from an external directory. This vulnerability highlights the risks associated with improper file handling in CLI tools.

References