Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/zx@3.0.0
purl pkg:npm/zx@3.0.0
Next non-vulnerable version 8.8.5
Latest non-vulnerable version 8.8.5
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-6duc-axb1-hueb
Aliases:
CVE-2025-13437
GHSA-w87r-vg9q-crqm
When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.
8.8.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T20:30:16.576497+00:00 GitLab Importer Affected by VCID-6duc-axb1-hueb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/zx/CVE-2025-13437.yml 38.6.0