CVE-2026-121746

The Node Version Manager (nvm) shell function in versions 0.40.0 through 0.40.8 is vulnerable to a symlink following issue (CWE-59). When using nvm use --save or nvm install --save (or -w), the tool uses tee to write the version string to $PWD/.nvmrc. If an attacker provides a repository where .n...

PT-2026-137188

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.40.0 through 0.40.8 Description When using the nvm use --save and nvm install --save or -w commands, the software writes the resolved version to the .nvmrc file using tee, which follows symbolic links. If a...