CVE-2026-121746

Received Received - Intake

Symlink Following Arbitrary File Write in Node Version Manager

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: harborist

Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows a symbolic link. A repository that commits `.nvmrc` as a symlink to a path outside itself (git recreates the link on clone) therefore makes `--save` truncate any file the user can write, such as a shell startup file or `~/.ssh/authorized_keys`, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so `git status` stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when `.nvmrc` in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-121746

Affected Vendors & Products

Vendor	Product	Version / Range
nvm-sh	nvm	0.40.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Node Version Manager (nvm) versions 0.40.0 through 0.40.8. When using commands like `nvm use --save` or `nvm install --save`, the tool writes the selected Node.js version to a file specified by `.nvmrc`. If `.nvmrc` is a symbolic link pointing outside the repository, the command follows the link and overwrites the target file with the version string. This can lead to data loss if the target file is important, such as shell startup files or SSH keys.

Detection Guidance

Check if your system uses nvm versions 0.40.0 through 0.40.8. Verify if .nvmrc files are symbolic links pointing outside their directories. Inspect files like shell startup files or ~/.ssh/authorized_keys for unexpected content changes.

Impact Analysis

This vulnerability can cause unintended data loss. If you have a repository with a symlinked `.nvmrc` pointing to a critical file like `~/.bashrc` or `~/.ssh/authorized_keys`, running `nvm use --save` or `nvm install --save` will overwrite that file with a Node.js version string. This could break your shell configuration or lock you out of SSH access.

Mitigation Strategies

Upgrade nvm to version 0.41.0 or later. Avoid using nvm use --save or nvm install --save in directories where .nvmrc is a symlink. Review .nvmrc files and system files for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-121746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...