---
id: "CVE-2026-121749"
kind: "vulnerability"
aliases: ["CVE-2026-121749"]
title: "nvm: a crafted .nvmrc can leak npm tokens to the terminal"
severity: "medium"
cvss: 4.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["developers", "node.js", "npm", "nvm", "runtime"]
not_affected_if: ["explicit-version-install", "no-untrusted-repos", "nvm-0.41.0-or-later"]
published_at: "2026-11-04T22:17:54+00:00"
first_seen_at: "2026-11-04T23:08:47+00:00"
updated_at: "2026-11-04T23:10:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121749", "first_seen_at": "2026-11-04T23:08:47+00:00"}]
exploit_sources: []
---

# nvm: a crafted .nvmrc can leak npm tokens to the terminal

Node Version Manager (nvm) passes the version string from a .nvmrc file to grep without guarding against leading dashes, so a first line beginning with '-' is read as grep options. A repository containing a symlink such as one to ../../.npmrc can then get part of the user's npm token printed to the terminal and sent in download URLs to the mirror.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the nvm version with `nvm --version` or by reading the installed nvm script; versions 0.5.0 through 0.40.8 are affected.
- Look in project directories you run `nvm install` in for a `.nvmrc` whose first line starts with `-`.

## Fix

- nvm: move to `0.41.0` or later, which passes every version pattern to grep with `-e`.

## Timeline

- 2026-11-04T23:08:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121749

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nvm-sh/nvm/security/advisories/GHSA-xmxw-6r9w-89gc
- [fix] Patch: github.com https://github.com/nvm-sh/nvm/commit/bce663e3873fadbe8ebbc6e07e8d76fb12d5d69e

## From the sources

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_remote_version`, and `nvm_ls_cached`. A `.nvmrc` whose first line starts with `-`, such as `-Rohenpm_[A-Za-z0-9]*`, is parsed as grep options; with GNU grep, `-R` searches the current directory recursively (following symlinks) instead of the version list. On a bare `nvm install`, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to `../../.npmrc` can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters `0-9A-Za-z._+-`. Version 0.41.0 passes every version pattern to grep with `-e`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_