nvm prints the contents of any readable file through a symlinked .nvmrc

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file (for example ../../.npmrc, or /proc/self/environ on Linux) makes a plain nvm use, nvm install, nvm which, nvm exec, nvm run, or nvm-exec read that file and print its contents in the invalid-.nvmrc message (even with --silent) or, for a one-line file, in the Found ... with version <...> message; with the README's zsh load-nvmrc or bash cdnvm hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked .nvmrc, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash cdnvm hook, which read .nvmrc itself, now gets the version from nvm, so users of that hook must also update their copy of it.

Üreticinin çözüm notu (İngilizce)

Upgrade to nvm 0.41.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…sh/nvm/security/advisories/GHSA-j6ch-mq5c-3h4x Üretici bülteni
• github.com/…ommit/67268ebcb6e1a26ae3d71b3710d6333bb7358662 Yama
• github.com/…ommit/c314f1cbb3c301c587a4e4f96511d31f1134ffd1 Yama

Kayıt geçmişi

1. 5 Kas 2026 00:30Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-121746nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
• 3,3 CVE-2026-121749nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
• 3,6 CVE-2026-121748nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
• 3,1 CVE-2026-121750nvm install --offline installs a cached tarball that previously failed checksum verification
• 2,5 CVE-2026-121745nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
• 3,1 CVE-2026-121751nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases