How severe is CVE-2025-13437?

CVE-2025-13437 has a CVSS 4.0 base score of 5.6, rated medium severity.

Is CVE-2025-13437 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-13437?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-13437 have an EU (EUVD) identifier?

Yes. CVE-2025-13437 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198297.

When was CVE-2025-13437 published?

CVE-2025-13437 was published on 2025-11-20 and last updated on 2026-06-17.

CVE-2025-13437

CVE-2025-13437 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-706.

Key facts

Severity: Medium (CVSS 4.0 base score 5.6)
EPSS exploit prediction: 0% (1st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-198297
Weakness: CWE-706
Published: 2025-11-20
Last modified: 2026-06-17

Description

When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.

Frequently asked questions

What is CVE-2025-13437?: When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external <path>/node_modules outside the current working directory.
How severe is CVE-2025-13437?: CVE-2025-13437 has a CVSS 4.0 base score of 5.6, rated medium severity.
Is CVE-2025-13437 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-13437?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-13437 have an EU (EUVD) identifier?: Yes. CVE-2025-13437 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-198297.
When was CVE-2025-13437 published?: CVE-2025-13437 was published on 2025-11-20 and last updated on 2026-06-17.

References

https://github.com/google/zx/issues/1348

Other CWE-706 vulnerabilities

CVE-2025-65474 — Critical (CVSS 9.8): An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows…
CVE-2024-35198 — Critical (CVSS 9.8): TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check…
CVE-2023-31814 — Critical (CVSS 9.8): D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.
CVE-2022-30258 — Critical (CVSS 9.8): An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name…
CVE-2022-30257 — Critical (CVSS 9.8): An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name…
CVE-2021-40539 — Critical (CVSS 9.8): Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with…

Browse all CWE-706 vulnerabilities →