---
id: "CVE-2026-121747"
kind: "vulnerability"
aliases: ["CVE-2026-121747"]
title: "nvm: symlinked .nvmrc leaks local file contents to terminal output"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bash", "ci", "node.js", "nvm", "package", "shell", "zsh"]
not_affected_if: ["default-config", "no-symlinked-nvmrc", "trusted-repos-only"]
published_at: "2026-11-04T22:17:54+00:00"
first_seen_at: "2026-11-04T23:08:47+00:00"
updated_at: "2026-11-04T23:10:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121747", "first_seen_at": "2026-11-04T23:08:47+00:00"}]
exploit_sources: []
---

# nvm: symlinked .nvmrc leaks local file contents to terminal output

Node Version Manager (nvm) follows a symbolic link named .nvmrc without checking it, so a repository can point it at another file such as .npmrc or /proc/self/environ. nvm then prints that file's contents in its error or version messages, where an attacker who can read the victim's output, such as a CI log, can see them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `nvm --version` and compare against the fixed release below.
- Look for a `.nvmrc` that is a symbolic link in repositories you clone or build, using `ls -l .nvmrc`.
- Check whether your shell loads nvm with the zsh `load-nvmrc` or bash `cdnvm` hook.

## Timeline

- 2026-11-04T23:08:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121747

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nvm-sh/nvm/security/advisories/GHSA-j6ch-mq5c-3h4x
- [fix] Patch: github.com https://github.com/nvm-sh/nvm/commit/67268ebcb6e1a26ae3d71b3710d6333bb7358662
- [fix] Patch: github.com https://github.com/nvm-sh/nvm/commit/c314f1cbb3c301c587a4e4f96511d31f1134ffd1

## From the sources

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to another file (for example `../../.npmrc`, or `/proc/self/environ` on Linux) makes a plain `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec` read that file and print its contents in the invalid-`.nvmrc` message (even with `--silent`) or, for a one-line file, in the `Found ... with version <...>` message; with the README's zsh `load-nvmrc` or bash `cdnvm` hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked `.nvmrc`, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash `cdnvm` hook, which read `.nvmrc` itself, now gets the version from nvm, so users of that hook must also update their copy of it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_