Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121748— nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.27.0 至 0.40.8 版本中，若项目的 文件设置了 选项，执行 时会提示用户运行 。该命令会在当前目录下执行 和 ，且未指定要编辑的配置文件。由于 npm 在决定编辑哪个文件之前会先加载项目的 ，因此该文件可决定目标文件：例如，设置 会导致 npm 以 INI 格式重写 ，从而破坏该文件；而设置 且 时，所选文件的权限会被设为 0666，在共享机器上允许其他本地用户写

CVSS 3.6 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121748

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
Source: CVE Program / CVE List V5
Vulnerability Description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm config delete prefix` and `npm config delete globalconfig` in the current directory without naming a config file. npm loads the project `.npmrc` before deciding which file to edit, so that file chooses the target: `userconfig=~/.bashrc` makes npm rewrite `~/.bashrc` as ini (corrupting it), and `location=global` with `globalconfig=` leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project `.npmrc` select which config file `--delete-prefix` edits.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0.27.0 ~ 0.41.0 -

II. Public POCs for CVE-2026-121748

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121748

请登录查看更多情报信息。

Other References for CVE-2026-121748 (2)

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121746 5.5 MEDIUM nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any fi
CVE-2026-121747 5.5 MEDIUM nvm prints the contents of any readable file through a symlinked .nvmrc
CVE-2026-121749 3.3 LOW nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options an
CVE-2026-121750 3.1 LOW nvm install --offline installs a cached tarball that previously failed checksum verificati
CVE-2026-121751 3.1 LOW nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via store
CVE-2026-121745 2.5 LOW nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-73