Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121745— nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.40.0 至 0.40.8 版本中，当设置了 环境变量时， 函数会将凭证作为 命令行参数传递给 curl 或 wget。由于进程参数对同一机器上的所有本地用户可见（在 Linux 上可通过 命令或 查看，除非 以 选项挂载；在 macOS 上可通过 查看），因此同一主机上的其他非特权账户可以在 nvm 执行 、 等命令进行下载时读取该令牌，从而获得该令牌在私有镜像仓库中所授

CVSS 2.5 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121745

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
Source: CVE Program / CVE List V5
Vulnerability Description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过处理环境导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0.40.0 ~ 0.41.0 -

II. Public POCs for CVE-2026-121745

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121745

请登录查看更多情报信息。

Other References for CVE-2026-121745 (2)

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121746 5.5 MEDIUM nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any fi
CVE-2026-121747 5.5 MEDIUM nvm prints the contents of any readable file through a symlinked .nvmrc
CVE-2026-121748 3.6 LOW nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes worl
CVE-2026-121749 3.3 LOW nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options an
CVE-2026-121750 3.1 LOW nvm install --offline installs a cached tarball that previously failed checksum verificati
CVE-2026-121751 3.1 LOW nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via store

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-214