Nvm, the Node Version Manager, fails to validate whether the .nvmrc file is a symbolic link in versions 0.2.0 through 0.40.8. A repository that supplies .nvmrc as a symlink to any readable file (for example ../../.npmrc or /proc/self/environ) causes nvm commands such as nvm use, nvm install, or nvm exec to read that target file and print its contents to standard output. The attacker learns the file data only through the output that is visible to anyone who can see the process’s console or CI log, and the data is not transmitted elsewhere. The vulnerability therefore results in unauthorized disclosure of potentially sensitive information but does not lead to code execution or privilege escalation.

The affected product is nvm‑sh:nvm, specifically all releases in the 0.2.0 through 0.40.8 range. The vendor recommends updating to version 0.41.0 or later to eliminate the flaw. Custom repository load scripts such as bash cdnvm or zsh load‑nvmrc that read .nvmrc directly must also be updated to accommodate the new behavior.

The CVSS score of 6.7 indicates a moderate severity. No EPSS score is reported and the vulnerability is not listed in CISA’s KEV catalog, yet the risk is non‑negligible in environments where untrusted code is executed, such as public CI pipelines or shared development directories. An attacker must be able to commit a symlinked .nvmrc to a project or have direct access to run nvm commands in the vulnerable directory; the exploit path is local and relies on the display of standard output. Because the data is only disclosed through output streams, the potential impact is limited to confidentiality breaches rather than system compromise.