CVE-2026-121748 in nvm
Summary
by MITRE • 11/05/2026
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm config delete prefix` and `npm config delete globalconfig` in the current directory without naming a config file. npm loads the project `.npmrc` before deciding which file to edit, so that file chooses the target: `userconfig=~/.bashrc` makes npm rewrite `~/.bashrc` as ini (corrupting it), and `location=global` with `globalconfig=` leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project `.npmrc` select which config file `--delete-prefix` edits.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
Node Version Manager serves as a critical utility for developers managing multiple Node.js environments on POSIX-compliant systems. A significant security vulnerability was identified in versions 0.27.0 through 0.40.8, where the interaction between nvm and npm configuration files creates severe integrity and confidentiality risks. The flaw is triggered when a user executes the command to delete prefix settings via nvm use --delete-prefix. This action initiates a sequence of operations within npm that fails to properly isolate the target configuration file from project-specific overrides, leading to unintended side effects on system or user-level files rather than just the local project context.
The technical root cause lies in the order of precedence and loading mechanisms within npm when handling configuration deletions. When nvm invokes npm config delete prefix and npm config delete globalconfig without explicitly specifying a target file path, npm defaults to its standard configuration resolution logic. This process involves reading the .npmrc file located in the current working directory before determining which actual file should be modified for the deletion operation. Consequently, if an attacker controls or influences the contents of this local .npmrc file, they can manipulate the destination of these write operations. The vulnerability allows an adversary to redirect configuration changes away from the intended scope into sensitive system files.
One specific exploitation vector involves setting the prefix variable in the project's .npmrc to point to ~/.bashrc. When nvm attempts to clean up the environment by deleting the prefix, npm interprets this directive and proceeds to rewrite the user's bash initialization file as an INI-formatted configuration file. This action corrupts the shell script, potentially breaking login sessions or command execution capabilities for the affected user. The attacker does not need to execute arbitrary code within the project; merely having a cloned repository with such a malicious .npmrc is sufficient to trigger this corruption when another developer runs nvm use in that directory.
A second exploitation vector targets file permissions and access control through the globalconfig setting. By configuring location=global alongside an empty or specific globalconfig path, the attacker can cause npm to write configuration data to a globally accessible file with overly permissive mode 0666 on shared systems. This permission level allows any local user on the same machine to read from and write to that file. An adversary could leverage this weakness to inject malicious environment variables or alter global Node.js settings, thereby establishing persistence or escalating privileges within the multi-user environment without requiring direct execution of project code.
The operational impact extends beyond simple configuration corruption. The ability to corrupt ~/.bashrc disrupts user productivity and system stability, while the permission escalation via 0666 files facilitates lateral movement among local users on shared infrastructure such as development servers or CI/CD runners. This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) in terms of unintended file modification and CWE-732 Incorrect Permission Assignment for Critical Resource due to the improper handling of file modes. From an ATT&CK perspective, this behavior relates to T1059 Command and Scripting Interpreter abuse through indirect execution via configuration files and potentially T1546 Event Triggered Execution if the corrupted bashrc leads to malicious script loading upon shell initialization.
Mitigation strategies focus on upgrading the Node Version Manager software immediately. Versions 0.41.0 and later have addressed this issue by preventing project-level .npmrc files from influencing which configuration file is edited during prefix deletion operations. This change ensures that nvm operates with a more predictable and secure scope, isolating local development environments from global system configurations. Until an upgrade can be performed, users should exercise extreme caution when working in repositories obtained from untrusted sources or shared directories. It is advisable to audit .npmrc files for suspicious prefix or globalconfig directives before executing any nvm commands that modify configuration states. Additionally, enforcing stricter default permissions on global config files and reviewing shell initialization scripts regularly can help detect early signs of such exploitation attempts.