nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to grep as a bare argument, without -e, in nvm_ls_remote_index_tab, nvm_remote_version, and nvm_ls_cached. A .nvmrc whose first line starts with -, such as -Rohenpm_[A-Za-z0-9]*, is parsed as grep options; with GNU grep, -R searches the current directory recursively (following symlinks) instead of the version list. On a bare nvm install, nvm then treats a matched string from those files as the version, prints it, and requests it from the configured mirror inside download URLs, so for example a repository containing a symlink to ../../.npmrc can leak the user's npm token to the terminal and to the mirror's and any proxy's logs. The disclosure is read-only and limited to the characters 0-9A-Za-z._+-. Version 0.41.0 passes every version pattern to grep with -e.

Üreticinin çözüm notu (İngilizce)

Upgrade to nvm 0.41.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…sh/nvm/security/advisories/GHSA-xmxw-6r9w-89gc Üretici bülteni
• github.com/…ommit/bce663e3873fadbe8ebbc6e07e8d76fb12d5d69e Yama

Kayıt geçmişi

1. 5 Kas 2026 00:31Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-121746nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
• 5,5 CVE-2026-121747nvm prints the contents of any readable file through a symlinked .nvmrc
• 3,6 CVE-2026-121748nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
• 3,1 CVE-2026-121750nvm install --offline installs a cached tarball that previously failed checksum verification
• 2,5 CVE-2026-121745nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
• 3,1 CVE-2026-121751nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases