Node Version Manager (nvm) fails to verify if the `.nvmrc` file is a symbolic link. An attacker can provide a repository or archive containing a `.nvmrc` file that symlinks to sensitive files, such as `../../.npmrc` or `/proc/self/environ` on Linux. When a user executes commands like `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec`, the contents of the linked file are printed in error messages or version confirmation messages. This can lead to information disclosure if the output is visible to the attacker, such as in CI logs. Additionally, users utilizing the `load-nvmrc` zsh hook or `cdnvm` bash hook may trigger this behavior simply by entering the directory.