# CVE-2026-121746: Node Version Manager arbitrary file overwrite via symlinked .nvmrc

Source: https://junglewise.ai/threats/cve-2026-121746-node-version-manager-nvm-is-a-posix-compliant-shell-function-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121746 · Severity: medium · CVSS 5.5 · Published 2026-11-04

Node Version Manager (nvm) is a shell utility for managing multiple Node.js installations on a single machine. When a user runs `nvm use --save` or `nvm install --save` in a repository containing a symlinked `.nvmrc` file pointing outside the repository, the tool follows the symlink and overwrites the target file with a version string, potentially destroying critical files like shell startup scripts or SSH keys. The attacker must trick the user into cloning a malicious repository and running the save command, resulting in data loss rather than code execution.

Vendors: [Nvm-Sh](https://junglewise.ai/threats/vendors/nvm-sh).

## Quick answers

**Is CVE-2026-121746 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121746 being exploited in the wild.

**How severe is CVE-2026-121746?** Medium severity, with a CVSS score of 5.5, published 4 November 2026.

**Which products and versions are affected?** Nvm-Sh Node Version Manager 0.40.0 through 0.40.8.

**Is there a fix for CVE-2026-121746?** Yes: fixed in 0.41.0. Until then: Do not use the `--save` or `-w` flags with `nvm use` and `nvm install` commands, or manually inspect `.nvmrc` files in cloned repositories to ensure they are regular files, not symlinks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121746 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-121746?** Check whether you run Nvm-Sh Node Version Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.41.0

Do not use the `--save` or `-w` flags with `nvm use` and `nvm install` commands, or manually inspect `.nvmrc` files in cloned repositories to ensure they are regular files, not symlinks.

## Technical details

The vulnerability is improper symlink resolution (CWE-59) in the `nvm_write_nvmrc` function when handling the `--save` flag with `nvm use` and `nvm install` commands. The function uses `tee` to write to `$PWD/.nvmrc` without checking if the file is a symlink, allowing it to follow symlinks and overwrite arbitrary files the user can write to. An attacker can commit a symlinked `.nvmrc` pointing to an external path (e.g., `~/.ssh/authorized_keys`), which Git recreates on clone, and when the victim runs the save commands, the target file is truncated and replaced with the resolved version string.

## Affected products

- nvm-sh Node Version Manager 0.40.0 through 0.40.8

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/nvm-sh/nvm/commit/3f8411e58d40b904e4ff6a96512391f56bd95bf7](https://github.com/nvm-sh/nvm/commit/3f8411e58d40b904e4ff6a96512391f56bd95bf7)
- [https://github.com/nvm-sh/nvm/security/advisories/GHSA-8qjx-8r8m-mpqh](https://github.com/nvm-sh/nvm/security/advisories/GHSA-8qjx-8r8m-mpqh)