CVE-2026-121746 in nvm
Summary
by MITRE • 11/05/2026
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows a symbolic link. A repository that commits `.nvmrc` as a symlink to a path outside itself (git recreates the link on clone) therefore makes `--save` truncate any file the user can write, such as a shell startup file or `~/.ssh/authorized_keys`, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so `git status` stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when `.nvmrc` in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
Node Version Manager serves as a widely adopted POSIX-compliant shell function designed to facilitate the management of multiple Node.js versions across different development environments. In specific releases ranging from version 0.40.0 through 0.40.8, a critical implementation flaw exists within the behavior of the `nvm use --save` and `nvm install --save` commands when interacting with configuration files. The vulnerability stems from the underlying mechanism used to write the resolved Node.js version string into the `.nvmrc` file located in the current working directory. Specifically, these versions utilize the standard Unix utility `tee` for this operation without implementing safeguards against symbolic link traversal or dangling link scenarios. This design choice creates a significant security gap because `tee`, by default, follows symbolic links to write data to their targets rather than writing to the link itself.
The operational impact of this flaw is severe and manifests as a local file overwrite vulnerability that can lead to substantial data loss. When a repository commits `.nvmrc` as a symbolic link pointing to a path outside its own directory structure, Git automatically recreates this symlink upon cloning by any user who pulls the project. If such a developer subsequently runs `nvm use --save` or `nvm install --save`, nvm will resolve the symlink and write the version string directly into the target file specified by that link. Because an attacker can control which repository is cloned, they can craft a malicious `.nvmrc` symlink pointing to sensitive system files such as shell startup scripts like `.bashrc` or `.zshrc`, or authentication configuration files like `~/.ssh/authorized_keys`. The execution of the nvm command will truncate these critical files and replace their contents with the Node.js version string, effectively destroying user configurations or disabling SSH access.
This vulnerability is particularly insidious due to its stealth characteristics within standard development workflows. Since only the target file is modified while the symbolic link itself remains intact, running `git status` in the repository will show no changes. The attacker does not need to inject arbitrary code execution payloads; instead, they rely on data loss and denial of service against the victim's local environment. This distinction classifies the issue primarily as a integrity violation rather than a direct remote code execution vector, although the consequences for system availability and user productivity are severe. The flaw exploits the trust developers place in open-source repositories to clone projects without verifying the nature of their configuration files, assuming that standard version control operations preserve file boundaries correctly.
From a technical classification perspective, this vulnerability aligns with CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, often referred to as path traversal or symlink following vulnerabilities. It also relates to CWE-732, concerning Incorrect Permission Assignment for Critical Resources, as the tool fails to restrict write operations based on the nature of the target file system object. In terms of adversary tactics, this scenario reflects techniques associated with ATT&CK ID T1564, specifically Hidden Files and Directories, where an attacker uses symbolic links to mask malicious activity from standard directory listings or version control status checks. The lack of validation allows for a silent compromise that persists until the user notices missing configurations or broken authentication methods.
Mitigation strategies focus on immediate updates and defensive coding practices within development workflows. Users running affected versions must upgrade Node Version Manager to version 0.41.0 or later, which introduces explicit safeguards against this behavior. The patched implementation detects when `.nvmrc` is a symbolic link, whether it points to an existing file or is dangling, and refuses to write the configuration change, issuing a warning instead of proceeding with the destructive operation. For organizations managing large fleets of developer machines, enforcing version control policies that prohibit committing symbolic links in repositories can prevent exposure at the source level. Additionally, developers should exercise caution when cloning untrusted repositories and verify the contents of hidden configuration files before executing package managers or environment setup scripts within those directories to ensure no symlink-based traps are present.