CVE-2026-121749
Description
A flaw was found in nvm. When processing version configuration files such as .nvmrc, input is passed to the search utility without proper option delimitation, allowing leading hyphens to be interpreted as command flags. An attacker who supplies a crafted configuration file can trick a user running nvm into reading unintended local files and following symbolic links. This flaw can lead to information disclosure, potentially exposing sensitive data such as authentication tokens in terminal output, network requests, and proxy logs.
Statement
This vulnerability is rated as Low severity because successful exploitation requires local user interaction to process an untrusted project file and only exposes limited read-only data without compromising system integrity or service availability. Red Hat Enterprise Linux and related container environments do not distribute Node Version Manager as an integrated system service or standard package, confining potential exposure to developer environments where the tool is installed independently. Furthermore, triggering the flaw requires an attacker to convince a user to run version management commands against a specially crafted configuration file.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
If an attacker can provide an untrusted input that contains argument-separating delimiters, then the resulting command will have more arguments than intended by the developer, potentially changing the expected behavior of the command. Depending on the functionality supported by the extraneous arguments, this may have security-relevant consequences. The attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified, or cause other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
