CVE-2026-121747

Received Received - Intake

Information Disclosure via Symlink in Node Version Manager

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: harborist

Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to another file (for example `../../.npmrc`, or `/proc/self/environ` on Linux) makes a plain `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec` read that file and print its contents in the invalid-`.nvmrc` message (even with `--silent`) or, for a one-line file, in the `Found ... with version <...>` message; with the README's zsh `load-nvmrc` or bash `cdnvm` hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked `.nvmrc`, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash `cdnvm` hook, which read `.nvmrc` itself, now gets the version from nvm, so users of that hook must also update their copy of it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-121747

Affected Vendors & Products

Vendor	Product	Version / Range
nvm-sh	nvm	0.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-61	The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Node Version Manager (nvm) versions 0.2.0 through 0.40.8 do not check if .nvmrc is a symbolic link. Attackers can create a symlink to sensitive files like .npmrc or /proc/self/environ. When users run commands like nvm use or nvm install, nvm reads the symlinked file and prints its contents in error messages or logs, exposing sensitive data to the attacker if they can view the output.

Detection Guidance

Check if .nvmrc files are symbolic links by running: find /path/to/project -name '.nvmrc' -type l. Review nvm commands in scripts or CI logs for unexpected file reads. Inspect directories where .nvmrc is used for symlinks pointing outside the project.

Impact Analysis

This vulnerability can expose sensitive information such as configuration files or environment variables if an attacker can view your command output or logs. It primarily affects users who run nvm commands in directories with symlinked .nvmrc files, especially in CI environments where logs are publicly accessible.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, potentially violating compliance requirements under GDPR (data protection) or HIPAA (health information privacy) if such data is leaked through logs or outputs. Organizations must ensure their nvm usage does not expose confidential information to mitigate compliance risks.

Mitigation Strategies

Upgrade nvm to version 0.41.0 or later. Remove or fix any symlinked .nvmrc files in your projects. Update bash zsh hooks (cdnvm, load-nvmrc) to versions compatible with nvm 0.41.0.

Hi! I’m here to help you understand CVE-2026-121747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...