nvm --save follows symlinked .nvmrc and overwrites files
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Node Version Manager (nvm) from 0.40.0 before 0.41.0 writes the resolved version to .nvmrc with tee, which follows symbolic links. A repository that commits .nvmrc as a symlink to a path outside itself makes nvm use --save or nvm install --save truncate and overwrite any file the user can write, such as a shell startup file, and it can create the target of a dangling link. The attacker does not control the content written, so the impact is data loss rather than code execution, and this requires a user to run the command in such a repository (CWE-59).
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows a symbolic link. A repository that commits `.nvmrc` as a symlink to a path outside itself (git recreates the link on clone) therefore makes `--save` truncate any file the user can write, such as a shell startup file or `~/.ssh/authorized_keys`, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so `git status` stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when `.nvmrc` in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade nvm to version 0.41.0. Version 0.41.0 refuses to write when .nvmrc in the current directory is a symlink, with a warning.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA nvm (nvm-sh) Fixed in 0.41.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
nvm-sh nvm 0.41.0
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrcPriority LOW 29
- TI-2026-85228 nvm passes .nvmrc contents to grep, leaking local filesPriority LOW 20
- TI-2026-85216 Command injection in nvm through malicious mirror LTS alias valuesPriority LOW 11
Vendor assessments
Timeline
- 2026-11-04 Threatist record created from CVE-2026-121746
- 2026-11-06 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Patch 1
Advisory 1
More nvm-sh vulnerabilities
- TI-2026-13337 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVSS 4.0LOW 2.1
- TI-2026-82282 Command injection in nvm lets version strings run arbitrary commands CVSS 4.0HIGH 7.1
- TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrc CVSS 4.0MEDIUM 6.7
- TI-2026-63368 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVSS 4.0MEDIUM 6.7
- TI-2026-01349 Command Injection in nvm via NVM_AUTH_HEADER in wget code path CVSS 4.0MEDIUM 5.4
- TI-2026-85228 nvm passes .nvmrc contents to grep, leaking local files CVSS 4.0MEDIUM 4.6
Sources
- CVE-2026-121746 · CVE Program
- CVE-2026-121746 · NVD
- FIRST EPSS
- CVE-2026-121746 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences