CVE-2026-121749 in nvm
Summary
by MITRE • 11/05/2026
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_remote_version`, and `nvm_ls_cached`. A `.nvmrc` whose first line starts with `-`, such as `-Rohenpm_[A-Za-z0-9]*`, is parsed as grep options; with GNU grep, `-R` searches the current directory recursively (following symlinks) instead of the version list. On a bare `nvm install`, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to `../../.npmrc` can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters `0-9A-Za-z._+-`. Version 0.41.0 passes every version pattern to grep with `-e`.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
Node Version Manager, commonly referred to as nvm, serves as a critical utility for developers managing multiple Node.js runtime versions across different projects and environments. In its earlier iterations ranging from version 0.5.0 through 0.40.8, the software contains a significant command injection vulnerability rooted in improper handling of user-supplied input when invoking external system commands. Specifically, within functions such as nvm_ls_remote_index_tab, nvm_remote_version, and nvm_ls_cached, the tool passes version patterns directly to the grep utility without using the -e flag to explicitly denote that the following argument is a pattern rather than an option or filename. This architectural oversight allows specially crafted inputs to be interpreted not as search queries but as command-line flags for grep, fundamentally altering the execution flow of the underlying shell process.
The core technical flaw manifests when a project configuration file, typically .nvmrc, contains a version string that begins with a hyphen character. For instance, if a developer sets their local Node.js version to -Rohenpm_[A-Za-z0-9]*, nvm passes this exact string as an argument to grep. Because the -e flag is omitted, GNU grep interprets the leading dash and subsequent characters as command-line options rather than literal text to search for. In many standard Linux distributions utilizing GNU coreutils, the -R option instructs grep to perform a recursive search through all files in the current directory tree while following symbolic links. This behavior transforms what should be a simple version lookup into an arbitrary file read operation across the filesystem accessible by the user running nvm.
The operational impact of this vulnerability is severe due to its potential for information disclosure and credential leakage. When grep executes recursively with symlink traversal enabled, it scans local files for matches against other patterns or simply outputs content from matched paths depending on specific invocation contexts within nvm's logic. If a repository contains symbolic links pointing to sensitive configuration files such as .npmrc, the contents of these files can be dumped into the terminal output during an installation process. Since npm tokens and authentication credentials are frequently stored in plaintext within .npmrc or similar dotfiles for convenience, this mechanism effectively exfiltrates private data. The leaked information is not only visible to the user but may also be transmitted to remote mirrors configured by nvm and logged by any intermediate proxies handling the download requests, thereby expanding the attack surface beyond local system boundaries.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as command injection, specifically through argument injection where user input modifies the behavior of invoked utilities. It also relates to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor and CWE-532 Insertion of Sensitive Information into Log File due to the logging implications mentioned in the disclosure. In terms of MITRE ATT&CK mapping, this scenario reflects techniques associated with T1087 Account Discovery or more broadly data exfiltration via local file access if leveraged within a broader exploitation chain, though primarily it represents an information leakage vector through misconfigured command execution parameters.
The vulnerability is constrained by certain limitations that affect its practical exploitability and scope of damage. The disclosure is read-only in nature, meaning the attacker cannot execute arbitrary commands or achieve remote code execution directly through this flaw alone. Furthermore, the characters accessible for exfiltration are limited to those found within version strings allowed by nvm, specifically alphanumeric characters along with dots, underscores, plus signs, and hyphens. This restriction means that while sensitive data can be leaked if it conforms to these character sets or is partially exposed through surrounding text, highly complex binary data or special symbols outside this range may not be fully recoverable via the standard output mechanism described.
Mitigation for organizations relying on affected versions of Node Version Manager involves immediate upgrading to version 0.41.0 or later, where the developers have corrected the issue by ensuring all version patterns are passed to grep with the -e flag explicitly set. This change forces grep to treat subsequent arguments as literal search strings rather than option flags, neutralizing the argument injection vector. For environments unable to upgrade immediately, administrators should enforce strict validation of .nvmrc files and other configuration inputs to ensure they do not begin with hyphens or contain patterns that could be misinterpreted by shell utilities. Additionally, auditing project directories for symbolic links pointing to sensitive dotfiles can reduce the risk profile associated with this flaw until patches are applied across all development workstations and CI/CD pipelines utilizing nvm.