CVE-2026-121749— nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files

Quick assessment

Affected

nvm-sh nvm

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.5.0 至 0.40.8 版本中，请求的版本模式在、和函数中被作为裸参数直接传递给，未使用选项。如果文件的第一行以开头（例如），该字符串会被解析为的选项；在使用 GNU grep 时，选项会递归搜索当前目录（并跟随符号链接），而非搜索版本列表。当执行裸命令时，nvm 会将从这些文件中匹配到的字符串视为版本号，将其打印到终端，并基于配置的镜像源中的下载

CVSS 3.3 · Low Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files

Source: CVE Program / CVE List V5

Vulnerability Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_remote_version`, and `nvm_ls_cached`. A `.nvmrc` whose first line starts with `-`, such as `-Rohenpm_[A-Za-z0-9]*`, is parsed as grep options; with GNU grep, `-R` searches the current directory recursively (following symlinks) instead of the version list. On a bare `nvm install`, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to `../../.npmrc` can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters `0-9A-Za-z._+-`. Version 0.41.0 passes every version pattern to grep with `-e`.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

参数注入或修改

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nvm-sh	nvm	0.5.0 ~ 0.41.0	-

II. Public POCs for CVE-2026-121749

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121749

请登录查看更多情报信息。

Other References for CVE-2026-121749 (2)

https://www.cve.org/CVERecord?id=CVE-2026-121749

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121746	5.5 MEDIUM	nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any fi
CVE-2026-121747	5.5 MEDIUM	nvm prints the contents of any readable file through a symlinked .nvmrc
CVE-2026-121748	3.6 LOW	nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes worl
CVE-2026-121750	3.1 LOW	nvm install --offline installs a cached tarball that previously failed checksum verificati
CVE-2026-121751	3.1 LOW	nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via store
CVE-2026-121745	2.5 LOW	nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

IV. Related Vulnerabilities

Same product: nvm

Same vendor: nvm-sh

Same weakness: CWE-88