CVE-2026-121749: nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to grep as a bare argument, without -e, in nvmlsremoteindextab, nvmremoteversion, and nvmlscached. A .nvmrc whose first line starts with -, such as -Rohenpm[A-Za-z0-9], is parsed as grep options; with GNU grep, -R searches the current directory recursively (following symlinks) instead of the version list. On a bare nvm install, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to ../../.npmrc can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters 0-9A-Za-z.+-. Version 0.41.0 passes every version pattern to grep with -e.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nvmto a version that resolves this vulnerability.Fixed in 0.41.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of nvm versions 0.5.0 through 0.40.8 are exposed when they run nvm commands that process an attacker-controlled .nvmrc, including a bare nvm install. The practical risk is greatest when working in an untrusted repository or directory that can contain a malicious .nvmrc and symlinks to sensitive local files.
What does an attacker need to exploit it?
An attacker needs to cause a user to run nvm against a directory containing a .nvmrc whose first line begins with a dash and supplies grep options. With GNU grep, a pattern using -R can recursively search the current directory and follow symlinks.
What information can be disclosed?
The issue is read-only and can disclose only characters in the set 0-9, A-Z, a-z, period, underscore, plus, and hyphen. Matched content may be printed to the terminal and incorporated into a mirror download URL, exposing it to the configured mirror and any proxy logs.
What should be done if upgrading is not immediately possible?
Do not run nvm install or other affected nvm operations in untrusted directories, and inspect .nvmrc files before using them. Avoid repositories containing suspicious .nvmrc entries beginning with a dash or symlinks that could point outside the repository.
How is the issue fixed?
Upgrade to nvm 0.41.0, which passes version patterns to grep using -e so they are treated as patterns rather than grep options.