CVE-2026-121747

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.2.0 through 0.40.8

Description Node Version Manager (nvm) fails to verify if the .nvmrc file is a symbolic link. An attacker can provide a repository or archive containing a .nvmrc file that symlinks to sensitive files, such as ../../.npmrc or /proc/self/environ on Linux. When a user executes commands like nvm use, nvm install, nvm which, nvm exec, nvm run, or nvm-exec, the contents of the linked file are printed in error messages or version confirmation messages. This can lead to information disclosure if the output is visible to the attacker, such as in CI logs. Additionally, users utilizing the load-nvmrc zsh hook or cdnvm bash hook may trigger this behavior simply by entering the directory.

Recommendations Update Node Version Manager (nvm) to version 0.41.0 or later. Users of the cdnvm bash hook should update their copy of the hook to ensure it retrieves the version from nvm rather than reading the .nvmrc file directly.