{"id":"CVE-2026-121745","kind":"vulnerability","aliases":["CVE-2026-121745"],"related":[],"title":"nvm: download auth token visible in process list to local users","description":"Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.","summary":"nvm 0.40.0 through 0.40.8 passes the NVM_AUTH_HEADER credential to curl or wget as a command-line argument during downloads. Any other local user on the same machine can read the token from the process list and use it to reach the private mirror it grants access to.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","nvm","package","private-mirror","shared-hosts"],"not_affected_if":["hidepid-set","no-nvm_auth_header","single-user-machine","version-0.41.0-or-later"],"how_to_check":"- `nvm --version` to see whether the installed version is between `0.40.0` and `0.40.8`\n- Check whether `NVM_AUTH_HEADER` is set in shell profiles or the environment of users on a shared host\n- Note whether `/proc` is mounted with `hidepid=` on Linux, since that limits who can read process arguments","fix":null,"status":"open","published_at":"2026-11-04T22:17:53+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","triaged_at":"2026-11-04T23:10:15+00:00","updated_at":"2026-11-04T23:10:15+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-04T23:10:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `0.41.0` or later, which passes the header to curl on stdin and to GNU Wget in a private temporary config file\n- BusyBox wget still receives the header as an argument in 0.41.0, per the sources","reach":"local","title":"nvm: download auth token visible in process list to local users","impact":"medium","summary":"nvm 0.40.0 through 0.40.8 passes the NVM_AUTH_HEADER credential to curl or wget as a command-line argument during downloads. Any other local user on the same machine can read the token from the process list and use it to reach the private mirror it grants access to.","audience":"developers","category":"package","nicknames":[],"who_cares":["nvm","node.js","shared-hosts","private-mirror"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads mirror token and gains its access","analyst_note":"","how_to_check":"- `nvm --version` to see whether the installed version is between `0.40.0` and `0.40.8`\n- Check whether `NVM_AUTH_HEADER` is set in shell profiles or the environment of users on a shared host\n- Note whether `/proc` is mounted with `hidepid=` on Linux, since that limits who can read process arguments","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-machine","no-NVM_AUTH_HEADER","hidepid-set","version-0.41.0-or-later"],"who_is_affected":"Only users who set NVM_AUTH_HEADER to reach a private package mirror on a host that other local accounts can log into are exposed. Single-user machines and setups without that variable are not affected. Systems where BusyBox wget is the only downloader still pass the header as an argument even on 0.41.0.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000772,"input_tokens":4500,"output_tokens":643,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-121745':14A,17A '-2026':13A,16A '/cmdline':134C '/proc':133C,136C '0.40.0':28B,94C '0.40.8':30B,96C '0.41.0':199C 'access':75B,174C 'account':148C,195C 'affect':197C 'anoth':146C 'argument':46B,119C,121C,238C 'auth':3A,34B,99C,186C 'author':115C 'avail':230C 'busybox':217C 'command':44B,117C,170C 'command-lin':43B,116C 'compliant':84C 'config':215C,221C 'credenti':36B,107C 'curl':38B,109C,204C 'cve':12A,15A 'download':2A,48B,104C,160C,229C 'everi':125C 'file':216C,222C 'function':86C 'gain':172C 'gnu':209C 'grant':74B,176C 'header':35B,100C,114C,187C,202C,232C 'hidepid':140C 'host':26B,190C 'instal':167C 'line':45B,118C 'linux':129C 'list':8A,64B 'local':10A,51B,126C,194C 'ls':164C 'ls-remot':163C 'machin':56B,152C 'maco':142C 'manag':78C,88C 'mirror':23B,72B,180C 'mount':138C 'multipl':89C 'node':76C 'node.js':18B,90C 'nvm':1A,19B,27B,33B,79C,98C,103C,158C,162C,166C,185C 'packag':20B 'pass':31B,105C,200C,235C 'posix':83C 'posix-compli':82C 'privat':22B,71B,179C,213C 'private-mirror':21B 'process':7A,63B,120C 'ps':131C,144C 'reach':69B 'read':58B,154C,219C 'remot':165C 'set':102C,184C 'share':25B,191C 'shared-host':24B 'shell':85C 'similar':169C 'stdin':206C 'still':234C 'temporari':214C 'token':4A,60B,156C 'unless':135C 'unprivileg':147C 'use':66B 'user':11A,52B,127C,182C 'version':77C,91C,93C,198C 'via':130C,143C 'visibl':5A,123C 'wget':40B,111C,210C,218C 'whatev':173C","nicknames":[],"mitigations":[],"who_affected":"Only users who set NVM_AUTH_HEADER to reach a private package mirror on a host that other local accounts can log into are exposed. Single-user machines and setups without that variable are not affected. Systems where BusyBox wget is the only downloader still pass the header as an argument even on 0.41.0.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","nodejs","nvm","package","privatemirror","sharedhosts"],"campaign_type":null,"first_public_at":"2026-11-04T21:27:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121745","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121745","severity":null,"published_at":"2026-11-04T22:17:53+00:00","modified_at":"2026-11-04T22:17:53+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","fetched_at":"2026-11-04T23:08:47+00:00","note":null}],"documents":[{"id":71128,"url":"https://github.com/nvm-sh/nvm/commit/903e3493699399d049f3af445c2d81688b6a7f5c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71129,"url":"https://github.com/nvm-sh/nvm/security/advisories/GHSA-h3c2-g6gc-6cgx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T21:27:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}