CVE-2025-13437 is a vulnerability in the zx CLI tool where invoking it with the --prefer-local=<path> option causes a symlink creation logic error. The CLI mistakenly deletes the target node_modules directory outside the current working directory due to improper handling of symlink paths during cleanup. This can lead to unintended deletion of external directories.