Information Exposure in Node Version Manager Vulnerable to Symlink Attack

CVE-2026-121747

What is CVE-2026-121747?

Node Version Manager (nvm), a shell function for managing multiple node.js versions, is affected by a vulnerability where it fails to check if the .nvmrc file is a symbolic link. This oversight allows attackers to create a symlink in a repository or archive, redirecting it to sensitive files such as ../../.npmrc or /proc/self/environ on Linux systems. When users execute commands like nvm use or nvm install, it inadvertently exposes the contents of these files through output messages, including logs in a Continuous Integration (CI) environment. Although version 0.41.0 addresses this vulnerability by no longer printing the contents of symlinked .nvmrc files, users must remain vigilant and update configurations accordingly to secure their environments.

References