Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
CVE-2026-121747
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file (for example ../../.npmrc, or /proc/self/environ on Linux) makes a plain nvm use, nvm install, nvm which, nvm exec, nvm run, or nvm-exec read that file and print its contents in the invalid-.nvmrc message (even with --silent) or, for a one-line file, in the Found ... with version message; with the README's zsh load-nvmrc or bash cdnvm hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked .nvmrc, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash cdnvm hook, which read .nvmrc itself, now gets the version from nvm, so users of that hook must also update their copy of it.
Assessment
- CVSS
- 6.7 (v4.0)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 4 November 2026
- Last updated
- 9 November 2026
- Weakness
- CWE-200, CWE-59, CWE-61
- Assigner
- 7ffcee3d-2c14-4c3e-b844-86c6a321a158
CVSS vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-121747