{"id":"CVE-2026-121748","kind":"vulnerability","aliases":["CVE-2026-121748"],"related":[],"title":"nvm: project .npmrc can make --delete-prefix corrupt or expose a config file","description":"Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm config delete prefix` and `npm config delete globalconfig` in the current directory without naming a config file. npm loads the project `.npmrc` before deciding which file to edit, so that file chooses the target: `userconfig=~/.bashrc` makes npm rewrite `~/.bashrc` as ini (corrupting it), and `location=global` with `globalconfig=` leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project `.npmrc` select which config file `--delete-prefix` edits.","summary":"nvm's `nvm use --delete-prefix` runs npm config deletes in the current directory without naming a config file, so a project's `.npmrc` can pick which file gets rewritten. An attacker who writes a cloned repository or shared directory can corrupt a file such as `~/.bashrc` or leave a global config writable by other local users.","severity":"low","cvss":3.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstations","node","nvm","package","shell"],"not_affected_if":["no-npmrc-prefix","nvm-0.41.0-or-later","nvm-below-0.27.0","single-user-machine"],"how_to_check":"- Check the nvm version with `nvm --version` or the installed nvm script version; versions `0.27.0` through `0.40.8` are affected.\n- Look for a `prefix` setting in project `.npmrc` files you use with `nvm use`.","fix":"- Move nvm to `0.41.0` or later, which no longer lets a project `.npmrc` select the file `--delete-prefix` edits.","status":"open","published_at":"2026-11-04T22:17:54+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","triaged_at":"2026-11-04T23:10:09+00:00","updated_at":"2026-11-04T23:10:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T23:10:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move nvm to `0.41.0` or later, which no longer lets a project `.npmrc` select the file `--delete-prefix` edits.","reach":"local","title":"nvm: project .npmrc can make --delete-prefix corrupt or expose a config file","impact":"low","summary":"nvm's `nvm use --delete-prefix` runs npm config deletes in the current directory without naming a config file, so a project's `.npmrc` can pick which file gets rewritten. An attacker who writes a cloned repository or shared directory can corrupt a file such as `~/.bashrc` or leave a global config writable by other local users.","audience":"developers","category":"package","nicknames":[],"who_cares":["nvm","node","shell","developer-workstations"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"A user's shell config is corrupted, or a global npm config becomes writable by other local users.","analyst_note":"","how_to_check":"- Check the nvm version with `nvm --version` or the installed nvm script version; versions `0.27.0` through `0.40.8` are affected.\n- Look for a `prefix` setting in project `.npmrc` files you use with `nvm use`.","plain_action":"","needs_analyst":false,"not_affected_if":["nvm-below-0.27.0","nvm-0.41.0-or-later","no-npmrc-prefix","single-user-machine"],"who_is_affected":"Developers who run nvm on a machine where they clone or open untrusted repositories, or on shared machines where other local users can write parent directories. Exposure requires a project `.npmrc` that sets `prefix` and a user who runs `nvm use --delete-prefix` in that directory. Teams that only use nvm on their own trusted projects on a single-user machine have low exposure.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000776,"input_tokens":4500,"output_tokens":651,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-121748':17A,20A '-2026':16A,19A '/.bashrc':75B,164C,168C '0.27.0':104C '0.40.8':106C '0.41.0':232C '0666':184C 'anoth':191C 'archiv':206C 'attack':60B,198C 'author':200C 'byte':224C 'choos':160C,218C 'chosen':180C 'clone':64B,203C 'code':229C 'compliant':94C 'config':13A,37B,46B,80B,129C,134C,144C,241C 'corrupt':9A,70B,171C 'current':41B,139C 'cve':15A,18A 'decid':152C 'delet':7A,33B,38B,124C,130C,135C,244C 'delete-prefix':6A,32B,123C,243C 'develop':22B 'developer-workst':21B 'directori':42B,68B,140C,217C 'edit':156C,246C 'expos':11A 'file':14A,47B,56B,72B,145C,154C,159C,181C,220C,242C 'function':96C 'get':57B 'global':79B,175C 'globalconfig':136C,177C 'ini':170C 'leav':77B,178C 'let':190C,235C 'load':147C 'local':84B,192C,209C 'locat':174C 'longer':234C 'machin':189C 'make':5A,165C 'manag':88C,98C 'mode':183C 'multipl':99C 'name':44B,142C 'node':24B,86C 'node.js':100C 'npm':36B,128C,133C,146C,166C 'npmrc':3A,52B,111C,150C,238C 'nvm':1A,25B,28B,30B,89C,114C,121C 'packag':26B 'parent':216C 'pick':54B 'posix':93C 'posix-compli':92C 'prefix':8A,34B,113C,125C,131C,245C 'project':2A,50B,109C,149C,228C,237C 'repositori':65B,204C 'rewrit':167C 'rewritten':58B 'run':35B,120C,127C,230C 'select':239C 'set':112C 'share':67B,188C,215C 'shell':27B,95C 'target':162C 'tell':116C 'use':31B,115C,122C 'user':85B,118C,193C,210C 'userconfig':163C 'version':87C,101C,103C,231C 'without':43B,141C 'workstat':23B 'writabl':81B 'write':62B,194C,213C 'written':225C","nicknames":[],"mitigations":[],"who_affected":"Developers who run nvm on a machine where they clone or open untrusted repositories, or on shared machines where other local users can write parent directories. Exposure requires a project `.npmrc` that sets `prefix` and a user who runs `nvm use --delete-prefix` in that directory. Teams that only use nvm on their own trusted projects on a single-user machine have low exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstations","low","node","nvm","package","shell"],"campaign_type":null,"first_public_at":"2026-11-04T21:29:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121748","severity":null,"published_at":"2026-11-04T22:17:54+00:00","modified_at":"2026-11-04T22:17:54+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","fetched_at":"2026-11-04T23:08:47+00:00","note":null}],"documents":[{"id":71136,"url":"https://github.com/nvm-sh/nvm/commit/4049296ca8eef2067517d8cfd5ef5c0e615daa10","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71137,"url":"https://github.com/nvm-sh/nvm/security/advisories/GHSA-ccgf-7gv4-xg5h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T21:29:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}