https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:58:03 +0000 https://cve.radiocsirt.org/vuln/brew-zx-cve-2025-13437 <p><strong>Affected:</strong> Homebrew: zx</p> <p>When zx is invoked with --prefer-local=&lt;path&gt;, the CLI creates a symlink named ./node_modules pointing to &lt;path&gt;/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external &lt;path&gt;/node_modules outside the current working directory.</p> <p><strong>Affected:</strong> Homebrew: zx</p> <p>When zx is invoked with --prefer-local=&lt;path&gt;, the CLI creates a symlink named ./node_modules pointing to &lt;path&gt;/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external &lt;path&gt;/node_modules outside the current working directory.</p> https://cve.radiocsirt.org/vuln/brew-zx-cve-2025-13437 https://cve.radiocsirt.org/vuln/euvd-2026-261472 EUVD-2026-261472 https://cve.radiocsirt.org/vuln/euvd-2026-261472 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13437 <p>When zx is invoked with --prefer-local=&lt;path&gt;, the CLI creates a symlink named ./node_modules pointing to &lt;path&gt;/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external &lt;path&gt;/node_modules outside the current working directory.</p> <p>When zx is invoked with --prefer-local=&lt;path&gt;, the CLI creates a symlink named ./node_modules pointing to &lt;path&gt;/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external &lt;path&gt;/node_modules outside the current working directory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-13437 https://cve.radiocsirt.org/vuln/ghsa-w87r-vg9q-crqm <p><strong>Affected:</strong> npm: zx</p> <p>When zx is invoked with --prefer-local=&lt;path&gt;, the CLI creates a symlink named ./node_modules pointing to &lt;path&gt;/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external &lt;path&gt;/node_modules outside the current working directory.</p> <p><strong>Affected:</strong> npm: zx</p> <p>When zx is invoked with --prefer-local=&lt;path&gt;, the CLI creates a symlink named ./node_modules pointing to &lt;path&gt;/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink path). The later cleanup routine removes what it received, which deletes the target directory itself. Result: zx can delete an external &lt;path&gt;/node_modules outside the current working directory.</p> https://cve.radiocsirt.org/vuln/ghsa-w87r-vg9q-crqm