CVE-2026-121746— nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write

Quick assessment

Affected

nvm-sh nvm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.40.0 至 0.40.8 版本中，和（或）命令会通过将解析后的版本写入，而会跟随符号链接。如果某个仓库将提交为指向其外部路径的符号链接（Git 在克隆时会重新创建该链接），那么使用选项时，任何用户可写入的文件（例如 Shell 启动文件或）都可能被截断，其内容被替换为版本字符串；或者会创建悬空链接的目标文件。由于链接本身未被修改，仍会显示为干净状态。攻

CVSS 5.5 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1562.001 T1562.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write

Source: CVE Program / CVE List V5

Vulnerability Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows a symbolic link. A repository that commits `.nvmrc` as a symlink to a path outside itself (git recreates the link on clone) therefore makes `--save` truncate any file the user can write, such as a shell startup file or `~/.ssh/authorized_keys`, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so `git status` stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when `.nvmrc` in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nvm-sh	nvm	0.40.0 ~ 0.41.0	-

II. Public POCs for CVE-2026-121746

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121746

请登录查看更多情报信息。

Other References for CVE-2026-121746 (2)

https://www.cve.org/CVERecord?id=CVE-2026-121746

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121747	5.5 MEDIUM	nvm prints the contents of any readable file through a symlinked .nvmrc
CVE-2026-121748	3.6 LOW	nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes worl
CVE-2026-121749	3.3 LOW	nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options an
CVE-2026-121750	3.1 LOW	nvm install --offline installs a cached tarball that previously failed checksum verificati
CVE-2026-121751	3.1 LOW	nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via store
CVE-2026-121745	2.5 LOW	nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

IV. Related Vulnerabilities

Same product: nvm

Same vendor: nvm-sh

Same weakness: CWE-59