CVE-2026-121746
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In nvm versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save (or -w) wrote the resolved version to $PWD/.nvmrc using tee, which follows symbolic links. A repository committing .nvmrc as a symlink to a path outside itself caused --save to truncate any user-writable file (e.g., a shell startup file or ~/.ssh/authorized_keys) and replace its contents with the version string.
Risk Assessment
May cause data loss and corruption of configuration files, including potential loss of SSH access.
Recommendation
Update nvm to version 0.41.0 or later, which refuses to write when .nvmrc is a symbolic link.
Other vulnerabilities in nvm
See all- CVE-2026-121747Medium
In nvm versions 0.2.0 through 0.40.8, nvm did not check whether .nvmrc is a symbolic link. A repository or archive shipping .nvmrc as a symlink to another file (e.g., ../../.npmrc or /proc/self/environ) caused nvm use, install, which, exec, run, or nvm-exec to read that file and print its contents in the invalid-.nvmrc message, which an attacker could observe e.g. in a CI log.
- CVE-2026-118905High
In nvm versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . and # but not backslash. A version string containing # closes the address early and the rest is parsed as sed commands, allowing shell command execution with GNU sed or file read/write with BSD sed.
- CVE-2026-94185Medium
nvm before 0.40.8 is vulnerable to path traversal in nvm_alias(), where a requested version or alias is treated as a filename under $NVM_DIR/alias without containment checks. A name containing '..' allows reading the first non-comment line of any file readable by the user, e.g. via .nvmrc in an untrusted repository. There is no integrity or availability impact and no code execution.
- CVE-2026-15921Low
Node Version Manager (nvm) versions 0.32.1 through 0.40.5 are vulnerable to path traversal when parsing LTS codenames from a mirror. A malicious mirror can inject path sequences like "../../../.bashrc", causing nvm to write version strings outside the intended alias directory, potentially overwriting shell startup files.
- CVE-2026-10796High
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. An attacker who controls the mirror or performs a man-in-the-middle attack on a non-TLS connection can run arbitrary commands on the victim's system.
Original NVD description (English source)
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows a symbolic link. A repository that commits `.nvmrc` as a symlink to a path outside itself (git recreates the link on clone) therefore makes `--save` truncate any file the user can write, such as a shell startup file or `~/.ssh/authorized_keys`, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so `git status` stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when `.nvmrc` in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS