CVE-2026-121748

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.27.0 through 0.40.8

Description When a project's .npmrc file sets the prefix variable, the nvm use command prompts the user to execute nvm use --delete-prefix. This action triggers npm config delete prefix and npm config delete globalconfig in the current directory without specifying a config file. Because npm loads the project .npmrc before determining which file to edit, an attacker can manipulate the target file. For instance, setting userconfig=~/.bashrc causes npm to rewrite ~/.bashrc as an ini file, leading to corruption. Alternatively, setting location=global and globalconfig= can leave the selected file with 0666 permissions, allowing other local users on a shared machine to write to it. This can be exploited by an author of a cloned repository or a local user with write access to a shared parent directory.

Recommendations Update Node Version Manager (nvm) to version 0.41.0.