Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121747— nvm prints the contents of any readable file through a symlinked .nvmrc

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.2.0 至 0.40.8 版本中，nvm 未检查 文件是否为符号链接。若某个仓库或归档将 配置为指向其他文件的符号链接（例如 ，或在 Linux 上指向 ），则执行普通的 、 、 、 、 或 命令时，nvm 会读取该目标文件并将其内容输出到"invalid .nvmrc"错误信息中（即使使用 选项）；对于单行文件，其内容还可能出现在"Found ... with versi

CVSS 5.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121747

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm prints the contents of any readable file through a symlinked .nvmrc
Source: CVE Program / CVE List V5
Vulnerability Description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to another file (for example `../../.npmrc`, or `/proc/self/environ` on Linux) makes a plain `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec` read that file and print its contents in the invalid-`.nvmrc` message (even with `--silent`) or, for a one-line file, in the `Found ... with version <...>` message; with the README's zsh `load-nvmrc` or bash `cdnvm` hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked `.nvmrc`, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash `cdnvm` hook, which read `.nvmrc` itself, now gets the version from nvm, so users of that hook must also update their copy of it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0.2.0 ~ 0.41.0 -

II. Public POCs for CVE-2026-121747

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121747

请登录查看更多情报信息。

Other References for CVE-2026-121747 (3)

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121746 5.5 MEDIUM nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any fi
CVE-2026-121748 3.6 LOW nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes worl
CVE-2026-121749 3.3 LOW nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options an
CVE-2026-121750 3.1 LOW nvm install --offline installs a cached tarball that previously failed checksum verificati
CVE-2026-121751 3.1 LOW nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via store
CVE-2026-121745 2.5 LOW nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-59