{"id":"CVE-2026-121749","kind":"vulnerability","aliases":["CVE-2026-121749"],"related":[],"title":"nvm: a crafted .nvmrc can leak npm tokens to the terminal","description":"Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_remote_version`, and `nvm_ls_cached`. A `.nvmrc` whose first line starts with `-`, such as `-Rohenpm_[A-Za-z0-9]*`, is parsed as grep options; with GNU grep, `-R` searches the current directory recursively (following symlinks) instead of the version list. On a bare `nvm install`, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to `../../.npmrc` can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters `0-9A-Za-z._+-`. Version 0.41.0 passes every version pattern to grep with `-e`.","summary":"Node Version Manager (nvm) passes the version string from a .nvmrc file to grep without guarding against leading dashes, so a first line beginning with '-' is read as grep options. A repository containing a symlink such as one to ../../.npmrc can then get part of the user's npm token printed to the terminal and sent in download URLs to the mirror.","severity":"medium","cvss":4.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developers","node.js","npm","nvm","runtime"],"not_affected_if":["explicit-version-install","no-untrusted-repos","nvm-0.41.0-or-later"],"how_to_check":"- Check the nvm version with `nvm --version` or by reading the installed nvm script; versions 0.5.0 through 0.40.8 are affected.\n- Look in project directories you run `nvm install` in for a `.nvmrc` whose first line starts with `-`.","fix":"- nvm: move to `0.41.0` or later, which passes every version pattern to grep with `-e`.","status":"open","published_at":"2026-11-04T22:17:54+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","triaged_at":"2026-11-04T23:10:09+00:00","updated_at":"2026-11-04T23:10:09+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-04T23:10:09Z","model":"claude-haiku-5-5","output":{"fix":"- nvm: move to `0.41.0` or later, which passes every version pattern to grep with `-e`.","reach":"local","title":"nvm: a crafted .nvmrc can leak npm tokens to the terminal","impact":"low","summary":"Node Version Manager (nvm) passes the version string from a .nvmrc file to grep without guarding against leading dashes, so a first line beginning with '-' is read as grep options. A repository containing a symlink such as one to ../../.npmrc can then get part of the user's npm token printed to the terminal and sent in download URLs to the mirror.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["nvm","node.js","npm","developers"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"npm token fragments printed to terminal and leaked to mirror logs","analyst_note":"","how_to_check":"- Check the nvm version with `nvm --version` or by reading the installed nvm script; versions 0.5.0 through 0.40.8 are affected.\n- Look in project directories you run `nvm install` in for a `.nvmrc` whose first line starts with `-`.","plain_action":"","needs_analyst":false,"not_affected_if":["nvm-0.41.0-or-later","explicit-version-install","no-untrusted-repos"],"who_is_affected":"Anyone who runs a bare `nvm install` inside a repository they did not write or fully trust, using nvm between 0.5.0 and 0.40.8. The exposure needs a .nvmrc whose first line starts with a dash plus a symlink pointing at a credentials file, and the disclosure is limited to the characters 0-9A-Za-z._+- . Teams that only use explicit version numbers, or who run a patched nvm, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000779,"input_tokens":4523,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121749':14A,17A '-2026':13A,16A '-9':240C '/../.npmrc':62B,207C '0':239C '0.40.8':105C '0.41.0':246C '0.5.0':103C '9':147C 'a-za-z':241C 'a-za-z0':143C 'argument':117C 'bare':116C,171C 'begin':46B 'cach':132C 'charact':238C 'compliant':93C 'configur':193C 'contain':55B,203C 'craft':3A 'current':159C 'cve':12A,15A 'dash':41B 'develop':18B 'directori':160C 'disclosur':229C 'download':80B,196C 'e':119C,254C 'everi':248C 'exampl':200C 'file':34B,182C 'first':44B,136C 'follow':162C 'function':95C 'get':65B 'gnu':154C 'grep':36B,51B,113C,151C,155C,252C 'guard':38B 'index':124C 'insid':195C 'instal':173C 'instead':164C 'lead':40B 'leak':6A,209C 'limit':235C 'line':45B,137C 'list':168C 'log':227C 'ls':122C,131C 'manag':25B,87C,97C 'match':178C 'mirror':84B,194C,221C 'multipl':98C 'node':23B,85C 'node.js':19B,99C 'npm':7A,20B,71B,213C 'nvm':1A,21B,26B,88C,121C,126C,130C,172C,174C 'nvmrc':4A,33B,134C 'one':60B 'option':52B,152C 'pars':149C 'part':66B 'pass':27B,111C,247C 'pattern':109C,250C 'posix':92C 'posix-compli':91C 'print':73B,186C 'proxi':225C 'r':156C 'read':49B,232C 'read-on':231C 'recurs':161C 'remot':123C,127C 'repositori':54B,202C 'request':107C,189C 'rohenpm':142C 'runtim':22B 'search':157C 'sent':78B 'shell':94C 'start':138C 'string':30B,179C 'symlink':57B,163C,205C 'tab':125C 'termin':11A,76B,217C 'token':8A,72B,214C 'treat':176C 'url':81B,197C 'user':69B,211C 'version':24B,29B,86C,100C,102C,108C,128C,167C,185C,245C,249C 'whose':135C 'without':37B,118C 'z':244C 'z0':146C 'za':145C,243C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs a bare `nvm install` inside a repository they did not write or fully trust, using nvm between 0.5.0 and 0.40.8. The exposure needs a .nvmrc whose first line starts with a dash plus a symlink pointing at a credentials file, and the disclosure is limited to the characters 0-9A-Za-z._+- . Teams that only use explicit version numbers, or who run a patched nvm, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developers","medium","nodejs","npm","nvm","runtime"],"campaign_type":null,"first_public_at":"2026-11-04T21:31:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121749","severity":null,"published_at":"2026-11-04T22:17:54+00:00","modified_at":"2026-11-04T22:17:54+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","fetched_at":"2026-11-04T23:08:47+00:00","note":null}],"documents":[{"id":71138,"url":"https://github.com/nvm-sh/nvm/commit/bce663e3873fadbe8ebbc6e07e8d76fb12d5d69e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71139,"url":"https://github.com/nvm-sh/nvm/security/advisories/GHSA-xmxw-6r9w-89gc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-04T21:31:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}