CVE-2026-121747: nvm prints the contents of any readable file through a symlinked .nvmrc
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file (for example ../../.npmrc, or /proc/self/environ on Linux) makes a plain nvm use, nvm install, nvm which, nvm exec, nvm run, or nvm-exec read that file and print its contents in the invalid-.nvmrc message (even with --silent) or, for a one-line file, in the Found ... with version <...> message; with the README's zsh load-nvmrc or bash cdnvm hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked .nvmrc, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash cdnvm hook, which read .nvmrc itself, now gets the version from nvm, so users of that hook must also update their copy of it.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nvmto a version that resolves this vulnerability.Fixed in 0.41.0 - Operational
Users of the README's bash cdnvm hook must update their copy so it gets the version from nvm instead of reading .nvmrc itself.
Event History
Frequently Asked Questions
Who is most likely to be exposed to this disclosure?
Users of nvm 0.2.0 through 0.40.8 who run nvm commands in untrusted repositories or extracted archives are exposed. The highest-risk cases are environments where command output is visible to an attacker, such as CI logs for a contributed branch, or where the README zsh load-nvmrc or bash cdnvm hook automatically processes a directory’s .nvmrc.
What must an attacker control to exploit this?
An attacker needs to provide a repository or archive containing a .nvmrc symbolic link that resolves to a file readable by the victim. They also need visibility into the victim’s output; nvm does not send the file contents to the attacker itself.
Are default nvm commands affected, and does --silent prevent disclosure?
Plain nvm use, nvm install, nvm which, nvm exec, nvm run, and nvm-exec can read and print the linked file’s contents. The disclosure can occur even when --silent is used.
What version resolves the content-disclosure behavior?
Version 0.41.0 no longer prints content read through a symlinked .nvmrc and accepts the file only when it contains a version or an existing alias name. Deliberate symlinks to another version file continue to work.
What else must be updated when using the bash cdnvm hook?
Users of the README bash cdnvm hook must update their local copy of that hook along with nvm. The updated hook obtains the version from nvm rather than reading .nvmrc itself.