CVE-2026-121746: nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save (or -w) write the resolved version to $PWD/.nvmrc with tee, which follows a symbolic link. A repository that commits .nvmrc as a symlink to a path outside itself (git recreates the link on clone) therefore makes --save truncate any file the user can write, such as a shell startup file or ~/.ssh/authorizedkeys, and replace its contents with the version string, or create the target of a dangling link; the link itself is left unchanged, so git status stays clean. The attacker does not control the content written, so this is data loss, not code execution. Version 0.41.0 refuses, with a warning, to write when .nvmrc in the current directory is a symlink, dangling or not, rather than writing through it or replacing it.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nvmto a version that resolves this vulnerability.Fixed in 0.41.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running nvm versions 0.40.0 through 0.40.8 are exposed when they run `nvm use --save` or `nvm install --save`/`-w` in a directory whose `.nvmrc` is a symbolic link. A cloned repository can recreate such a committed symlink automatically.
What does exploitation require?
An attacker needs to cause the user to work in a repository containing a `.nvmrc` symlink and to invoke one of the affected save options. The symlink target must be a file the user is allowed to write, including a nonexistent target for a dangling link.
What is the impact if the issue is triggered?
The target file is truncated and replaced with the resolved Node.js version string, or created if the link target does not exist. The available information describes data loss rather than code execution, because the attacker does not control the written content.
How can I mitigate the issue if I cannot update immediately?
Do not use `nvm use --save` or `nvm install --save`/`-w` in untrusted or unreviewed repositories. Inspect `.nvmrc` for symbolic links before using these options, including links whose targets are outside the repository or dangling.
How do I know whether the vulnerable write may have occurred?
Check whether `.nvmrc` in the working directory is a symlink and review files it targets for replacement by a Node.js version string. The symlink itself remains unchanged, so `git status` can remain clean even after the target has been overwritten.