nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfig in the current directory without naming a config file. npm loads the project .npmrc before deciding which file to edit, so that file chooses the target: userconfig=~/.bashrc makes npm rewrite ~/.bashrc as ini (corrupting it), and location=global with globalconfig= leaves the chosen file at mode 0666, which on a shared machine lets another local user write to it. The attacker (the author of a cloned repository or archive, or a local user who can write a shared parent directory) chooses the file but not the bytes written, and no project code runs. Version 0.41.0 no longer lets a project .npmrc select which config file --delete-prefix edits.

Üreticinin çözüm notu (İngilizce)

Upgrade to nvm 0.41.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…sh/nvm/security/advisories/GHSA-ccgf-7gv4-xg5h Üretici bülteni
• github.com/…ommit/4049296ca8eef2067517d8cfd5ef5c0e615daa10 Yama

Kayıt geçmişi

1. 5 Kas 2026 00:29Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-121746nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
• 3,3 CVE-2026-121749nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
• 5,5 CVE-2026-121747nvm prints the contents of any readable file through a symlinked .nvmrc
• 3,1 CVE-2026-121750nvm install --offline installs a cached tarball that previously failed checksum verification
• 2,5 CVE-2026-121745nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
• 3,1 CVE-2026-121751nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases