Skip to content
OpenAdvisories

Package · npm

zx

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.6
    CVE-2025-13437

    Arbitrary node_modules Directory Deletion in Google zx

    When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink p…

    Google zx zx npm