CVE-2026-121749

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.5.0 through 0.40.8

Description In the nvm ls remote index tab, nvm remote version, and nvm ls cached functions, the requested version pattern is passed to grep as a bare argument without the -e flag. A .nvmrc file starting with a - character, such as -Rohenpm [A-Za-z0-9]*, can be interpreted as grep options. When using GNU grep, the -R option triggers a recursive search of the current directory. During a bare nvm install command, any matched string from these files is treated as a version and requested from the configured mirror. This process can lead to the disclosure of sensitive information, such as an npm token, by leaking it to the terminal and to the logs of the mirror or proxy. The disclosure is read-only and limited to characters 0-9A-Za-z. +-.

Recommendations Update Node Version Manager (nvm) to version 0.41.0.