# CVE-2026-121747: Node Version Manager symlinked .nvmrc file read disclosure

Source: https://junglewise.ai/threats/cve-2026-121747-node-version-manager-nvm-is-a-posix-compliant-shell-function-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121747 · Severity: medium · CVSS 5.5 · Published 2026-11-04

Node Version Manager (nvm) is a shell tool for managing multiple Node.js versions on a single machine. When a repository contains a `.nvmrc` file as a symbolic link pointing to sensitive files elsewhere on the system, running standard nvm commands or entering the directory automatically reads and displays the contents of that target file to the user's terminal, potentially exposing secrets like credentials or environment variables to an attacker with access to logs or output.

Technologies: [Nvm-Sh Nvm](https://junglewise.ai/threats/technologies/nvm). Vendors: [Nvm-Sh](https://junglewise.ai/threats/vendors/nvm-sh).

## Quick answers

**Is CVE-2026-121747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121747 being exploited in the wild.

**How severe is CVE-2026-121747?** Medium severity, with a CVSS score of 5.5, published 4 November 2026.

**Which products and versions are affected?** Nvm-Sh Nvm 0.2.0 through 0.40.8.

**Is there a fix for CVE-2026-121747?** Yes: fixed in 0.41.0. Until then: Users relying on the bash `cdnvm` hook documented in the README must update their hook implementation to use nvm_process_nvmrc instead of directly reading `.nvmrc`, as shown in the 0.41.0 update. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121747 attacked?** It is attacked with local access or from the adjacent network, in a software library.

**Am I affected by CVE-2026-121747?** Check whether you run Nvm-Sh Nvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.41.0

Users relying on the bash `cdnvm` hook documented in the README must update their hook implementation to use nvm_process_nvmrc instead of directly reading `.nvmrc`, as shown in the 0.41.0 update.

## Technical details

The vulnerability exists in versions 0.2.0 through 0.40.8 where the nvm_process_nvmrc function does not validate whether `.nvmrc` is a symbolic link before reading and processing its contents. An attacker can craft a repository with `.nvmrc` symlinked to sensitive files (e.g., `../../.npmrc`, `/proc/self/environ`) and the contents are printed in error messages or version output. Version 0.41.0 fixes this by refusing to print contents of symlinked `.nvmrc` files while still allowing legitimate symlinks to version files.

## Affected products

- nvm-sh nvm 0.2.0 through 0.40.8

## Timeline

- 2026-11-04: disclosed
- 2026: patched: Version 0.41.0 released

## References

- [https://github.com/nvm-sh/nvm/commit/67268ebcb6e1a26ae3d71b3710d6333bb7358662](https://github.com/nvm-sh/nvm/commit/67268ebcb6e1a26ae3d71b3710d6333bb7358662)
- [https://github.com/nvm-sh/nvm/commit/c314f1cbb3c301c587a4e4f96511d31f1134ffd1](https://github.com/nvm-sh/nvm/commit/c314f1cbb3c301c587a4e4f96511d31f1134ffd1)

## Related threats

- [nvm path traversal in LTS alias creation](https://junglewise.ai/threats/cve-2026-15921-nvm-path-traversal-in-lts-alias-creation)
- [nvm OS command injection via malicious mirror version strings](https://junglewise.ai/threats/cve-2026-10796-nvm-os-command-injection-via-malicious-mirror-version-strings)