CVE-2026-121749

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_remote_version`, and `nvm_ls_cached`. A `.nvmrc` whose first line starts with `-`, such as `-Rohenpm_[A-Za-z0-9]*`, is parsed as grep options; with GNU grep, `-R` searches the current directory recursively (following symlinks) instead of the version list. On a bare `nvm install`, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to `../../.npmrc` can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters `0-9A-Za-z._+-`. Version 0.41.0 passes every version pattern to grep with `-e`.

• CWE-88

• https://github.com/nvm-sh/nvm/commit/bce663e3873fadbe8ebbc6e07e8d76fb12d5d69e
• https://github.com/nvm-sh/nvm/security/advisories/GHSA-xmxw-6r9w-89gc

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-121736NocoDB 0.300.0 before 2026.08.0 contains a missing authentic…5.3
• CVE-2026-12174A security vulnerability has been detected in D-Link DCS-935…8.8
• CVE-2026-121745Node Version Manager (nvm) is a POSIX-compliant shell functi…2.5
• CVE-2026-121746Node Version Manager (nvm) is a POSIX-compliant shell functi…5.5
• CVE-2026-121747Node Version Manager (nvm) is a POSIX-compliant shell functi…5.5
• CVE-2026-121748Node Version Manager (nvm) is a POSIX-compliant shell functi…3.6
• CVE-2026-12175A vulnerability was detected in CodeAstro Student Attendance…4.7
• CVE-2026-121750Node Version Manager (nvm) is a POSIX-compliant shell functi…3.1
• CVE-2026-121751Node Version Manager (nvm) is a POSIX-compliant shell functi…3.1
• CVE-2026-12176A vulnerability has been found in SourceCodester CET Automat…4.3
• CVE-2026-1218A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0…6.3
• CVE-2026-121802@better-auth/expo before 1.7.16 allows certain account-takeo…9.1