Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the zx CLI tool when the `–prefer-local` flag is used. This option triggers a function to create a symbolic link named `./node_modules` pointing to the global `/node_modules` directory. A logic error within the `linkNodeModules` function in `src/cli.ts` causes it to return the absolute target path (/node_modules) instead of the path to the locally created symlink (./node_modules). This incorrect path is then passed to a cleanup routine. Consequently, the cleanup process, intending to remove the temporary symlink, instead deletes the absolute target directory it received. This results in the unintended deletion of the global `/node_modules` directory, which is external to the current working directory.
Platform: zx
Version: <9.1.15
Vulnerability: Directory Deletion
Severity: Moderate
date: 2025-11-20
Prediction: Patch 2025-11-27
What Undercode Say:
find / -name node_modules -type d 2>/dev/null rm -rf /node_modules npx zx --prefer-local script.mjs
// src/cli.ts (vulnerable function)
async function linkNodeModules(target: string): Promise<string> {
// ... creates symlink ./node_modules -> target
return target; // Logic error: returns target path instead of symlink path
}
How Exploit:
–prefer-local flag
Protection from this CVE
Update to v9.1.15.
Impact:
Data loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
