CVE-2026-121746

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.40.0 through 0.40.8

Description When using the nvm use --save and nvm install --save (or -w) commands, the software writes the resolved version to the .nvmrc file using tee, which follows symbolic links. If a repository contains a .nvmrc file that is a symbolic link to a path outside the repository, the --save operation can truncate any file the user has permission to write—such as shell startup files or ~/.ssh/authorized keys—and replace its contents with the version string. This can also create the target of a dangling link. Because the symbolic link itself remains unchanged, the action does not appear in git status. This issue results in data loss rather than code execution, as the attacker cannot control the content being written.

Recommendations Update Node Version Manager (nvm) to version 0.41.0.