Read the docs
TI-2026-85228 Aliases CVE-2026-121749

nvm passes .nvmrc contents to grep, leaking local files

Priority LOW 20CWE-88Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

Node Version Manager (nvm) from 0.5.0 before 0.41.0 passes the requested version pattern to grep without -e. A .nvmrc whose first line starts with a dash is parsed as grep options, so GNU grep can search the current directory recursively instead of the version list. On a bare nvm install, a matched string from those files is printed and requested from the configured mirror, which can leak a user's npm token to the terminal and to mirror or proxy logs; the disclosure is read-only and limited to a small character set. An attacker needs a local user to run nvm install in a crafted repository with user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_remote_version`, and `nvm_ls_cached`. A `.nvmrc` whose first line starts with `-`, such as `-Rohenpm_[A-Za-z0-9]*`, is parsed as grep options; with GNU grep, `-R` searches the current directory recursively (following symlinks) instead of the version list. On a bare `nvm install`, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to `../../.npmrc` can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters `0-9A-Za-z._+-`. Version 0.41.0 passes every version pattern to grep with `-e`.

Why it matters now

EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed nvm (nvm-sh): 0.41.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
nvm-shnvm0.5.0 to before 0.41.00.41.0Patch availableCNA
  • nvm Vendornvm-sh Affected 0.5.0 to before 0.41.0 Fixed in 0.41.0 Patch available CNA

Remediation

Update nvm to version 0.41.0, which passes every version pattern to grep with -e.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA nvm (nvm-sh) Fixed in 0.41.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    nvm-sh nvm 0.41.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrcPriority LOW 29
    • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites filesPriority LOW 29
    • TI-2026-85216 Command injection in nvm through malicious mirror LTS alias valuesPriority LOW 11
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121749
  2. 2026-11-07 Affected versions changed · Red Hat
  3. 2026-11-07 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2026-13337 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVSS 4.0LOW 2.1
  • TI-2026-82282 Command injection in nvm lets version strings run arbitrary commands CVSS 4.0HIGH 7.1
  • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrc CVSS 4.0MEDIUM 6.7
  • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites files CVSS 4.0MEDIUM 6.7
  • TI-2026-63368 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVSS 4.0MEDIUM 6.7
  • TI-2026-01349 Command Injection in nvm via NVM_AUTH_HEADER in wget code path CVSS 4.0MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences