CVE-2026-121746

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save or -w write the resolved version to $PWD/.nvmrc with tee, which follows a symbolic link. A repository that commits .nvmrc a...

CVE-2026-121746

The Node Version Manager (nvm) shell function in versions 0.40.0 through 0.40.8 is vulnerable to a symlink following issue (CWE-59). When using nvm use --save or nvm install --save (or -w), the tool uses tee to write the version string to $PWD/.nvmrc. If an attacker provides a repository where .n...

CVE-2026-121746 nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save or -w write the resolved version to $PWD/.nvmrc with tee, which follows a symbolic link. A repository that commits .nvmrc a...

PT-2026-137188

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.40.0 through 0.40.8 Description When using the nvm use --save and nvm install --save or -w commands, the software writes the resolved version to the .nvmrc file using tee, which follows symbolic links. If a...