CVE-2026-121746
Description
A flaw was found in Node Version Manager (nvm). When saving a version configuration, nvm follows symbolic links without verifying whether the target file resides outside the working directory. By convincing a user to execute save commands within a malicious repository containing a crafted symbolic link, an attacker can overwrite arbitrary files accessible to that user. Successful exploitation replaces target file contents with version details, leading to data loss.
Statement
This vulnerability is rated as Moderate impact because exploitation requires user interaction to clone and execute specific commands within an untrusted repository containing a crafted symbolic link. Although arbitrary user-accessible files can be overwritten, the replaced data is confined to static version information rather than attacker-controlled code, limiting the severity to local data loss rather than arbitrary code execution. Furthermore, Node Version Manager is an auxiliary developer utility that is not deployed as a standard system service in default enterprise environments.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
