Shell Function Vulnerability in Node Version Manager by NVM
CVE-2026-121749

4.6MEDIUM

Key Information:

Vendor

Nvm-sh

Status
Nvm
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121749?

A vulnerability exists in Node Version Manager (nvm) where an attacker can exploit the way version patterns are passed to grep in certain functions. If a .nvmrc file starts with a dash (-), it is interpreted as grep options, potentially exposing sensitive user data like npm tokens through unintended command execution. This could allow attackers to retrieve information about the user's npm configuration. The vulnerability affects versions 0.5.0 through 0.40.8, with remedial actions taken in version 0.41.0 to mitigate this issue.

Affected Version(s)

nvm 0.5.0 < 0.41.0

References

https://github.com/nvm-sh/nvm/security/advisories/GHSA-xm...
vendor-advisory
https://github.com/nvm-sh/nvm/commit/bce663e3873fadbe8ebb...
patch

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic's OSS Scanner, as vulnerability ANT-2026-EN9DM7WC
Jordan Harband (https://github.com/ljharb)
.