CVE-2026-121745
Description
A flaw was found in Node Version Manager (nvm). When downloading files or querying remote resources using custom authentication headers, authorization credentials are passed directly as command-line arguments to external download utilities. A local attacker on a shared system can observe running process arguments, leading to information disclosure of sensitive authentication tokens.
Statement
This vulnerability is rated as Low severity because successful credential exposure requires an unprivileged local attacker to inspect process tables during a transient execution window, and it solely affects systems configured with custom authentication headers for private mirrors. Red Hat products do not distribute Node Version Manager by default, limiting potential exposure to user-managed developer environments where multi-tenant access is uncommon. Additionally, the flaw is restricted to local token disclosure and does not compromise system availability or integrity.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
When this data contains sensitive information such as credentials, it might allow other users to launch an attack against the product or related resources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
