CVE-2026-121747

In nvm versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save (or -w) wrote the resolved version to $PWD/.nvmrc using tee, which follows symbolic links. A repository committing .nvmrc as a symlink to a path outside itself caused --save to truncate any user-writable file (e.g., a shell startup file or ~/.ssh/authorized_keys) and replace its contents with the version string.

In nvm versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . and # but not backslash. A version string containing # closes the address early and the rest is parsed as sed commands, allowing shell command execution with GNU sed or file read/write with BSD sed.

nvm before 0.40.8 is vulnerable to path traversal in nvm_alias(), where a requested version or alias is treated as a filename under $NVM_DIR/alias without containment checks. A name containing '..' allows reading the first non-comment line of any file readable by the user, e.g. via .nvmrc in an untrusted repository. There is no integrity or availability impact and no code execution.

Node Version Manager (nvm) versions 0.32.1 through 0.40.5 are vulnerable to path traversal when parsing LTS codenames from a mirror. A malicious mirror can inject path sequences like "../../../.bashrc", causing nvm to write version strings outside the intended alias directory, potentially overwriting shell startup files.

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. An attacker who controls the mirror or performs a man-in-the-middle attack on a non-TLS connection can run arbitrary commands on the victim's system.