Read the docs
TI-2026-85214 Aliases CVE-2026-121748

Project .npmrc can redirect nvm --delete-prefix to other config files

Priority LOW 9CWE-73Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Node Version Manager (nvm) from 0.27.0 before 0.41.0 lets a project's .npmrc pick the config file that nvm use --delete-prefix edits (CWE-73). npm reads the project .npmrc before choosing its target, so a crafted file can make npm rewrite another file as ini or leave it at mode 0666. An attacker who authors a cloned repository or archive, or a local user who can write a shared parent directory, picks the file but not the content, when a user runs the command.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm config delete prefix` and `npm config delete globalconfig` in the current directory without naming a config file. npm loads the project `.npmrc` before deciding which file to edit, so that file chooses the target: `userconfig=~/.bashrc` makes npm rewrite `~/.bashrc` as ini (corrupting it), and `location=global` with `globalconfig=` leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project `.npmrc` select which config file `--delete-prefix` edits.

Why it matters now

EPSS 0.00127 2nd percentileScored 2026-11-07
Fix Fixed nvm (nvm-sh): 0.41.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nvm-shnvm0.27.0 to before 0.41.00.41.0Patch availableCNA
  • nvm Vendornvm-sh Affected 0.27.0 to before 0.41.0 Fixed in 0.41.0 Patch available CNA

Remediation

Upgrade nvm to 0.41.0, which no longer lets a project .npmrc select the file that --delete-prefix edits.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA nvm (nvm-sh) Fixed in 0.41.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    nvm-sh nvm 0.41.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrcPriority LOW 29
    • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites filesPriority LOW 29
    • TI-2026-85228 nvm passes .nvmrc contents to grep, leaking local filesPriority LOW 20
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121748
  2. 2026-11-07 Affected versions changed · Red Hat
  3. 2026-11-07 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2026-13337 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVSS 4.0LOW 2.1
  • TI-2026-82282 Command injection in nvm lets version strings run arbitrary commands CVSS 4.0HIGH 7.1
  • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrc CVSS 4.0MEDIUM 6.7
  • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites files CVSS 4.0MEDIUM 6.7
  • TI-2026-63368 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVSS 4.0MEDIUM 6.7
  • TI-2026-01349 Command Injection in nvm via NVM_AUTH_HEADER in wget code path CVSS 4.0MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences