Vulnerability in Node Version Manager for Managing Node.js Versions
CVE-2026-121748

1.8LOW

Key Information:

Vendor

Nvm-sh

Status
Nvm
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121748?

The Node Version Manager (nvm) has a vulnerability present in several versions that allows a project’s .npmrc setting a custom prefix to improperly influence configuration file modifications. When executed, the command nvm use --delete-prefix leads to unintended edits to important configuration files without explicitly naming them. This can corrupt user configuration files such as ~/.bashrc or leave them with insecure permissions, which could be exploited by local users on shared systems. The issue has been resolved in version 0.41.0, which prevents a project's .npmrc from determining the configuration file targeted by the --delete-prefix option.

Affected Version(s)

nvm 0.27.0 < 0.41.0

References

https://github.com/nvm-sh/nvm/security/advisories/GHSA-cc...
vendor-advisory
https://github.com/nvm-sh/nvm/commit/4049296ca8eef2067517...
patch

CVSS V4

Score:
1.8
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic's OSS Scanner, as vulnerability ANT-2026-WYRTKBQ5
Jordan Harband (https://github.com/ljharb)
.