CVE-2026-121748

Received Received - Intake

Privilege Escalation in Node Version Manager via npm Config Manipulation

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: harborist

Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm config delete prefix` and `npm config delete globalconfig` in the current directory without naming a config file. npm loads the project `.npmrc` before deciding which file to edit, so that file chooses the target: `userconfig=~/.bashrc` makes npm rewrite `~/.bashrc` as ini (corrupting it), and `location=global` with `globalconfig=` leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project `.npmrc` select which config file `--delete-prefix` edits.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-121748

EUVD

EUVD-2026-117129

Affected Vendors & Products

Vendor	Product	Version / Range
nvm-sh	nvm	0.27.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability affects Node Version Manager (nvm) versions 0.27.0 through 0.40.8. When a project's .npmrc file sets a prefix, running nvm use --delete-prefix can corrupt or expose configuration files like ~/.bashrc or shared config files by allowing unintended file modifications or permission changes.

Detection Guidance

This vulnerability is specific to nvm versions 0.27.0 through 0.40.8 and involves corruption of config files like ~/.bashrc or setting insecure permissions. Check your nvm version with 'nvm --version'. If it falls within the vulnerable range, inspect ~/.bashrc and other npm config files for unexpected changes or permissions set to 0666.

Impact Analysis

An attacker could exploit this by manipulating .npmrc in a project or shared directory to corrupt your shell configuration file (e.g., ~/.bashrc) or change permissions on config files, potentially allowing other users on a shared system to modify them. This could lead to system instability or unauthorized access.

Mitigation Strategies

Upgrade nvm to version 0.41.0 or later immediately. Avoid running 'nvm use --delete-prefix' in project directories with .npmrc files. Review and correct permissions on ~/.bashrc and other npm config files if they were modified.

Hi! I’m here to help you understand CVE-2026-121748. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...