In Node Version Manager (nvm) versions 0.27.0 through 0.40.8, a project’s .npmrc can specify a prefix setting. When a user runs nvm use with the --delete-prefix flag, nvm executes npm config delete prefix and npm config delete globalconfig without naming a configuration file. npm loads the project .npmrc first, so the settings in that file determine which configuration file is edited. The attacker can cause npm to overwrite a user’s own configuration file (for example, corrupting ~/.bashrc when the prefix setting points to it) or to set the target file to mode 0666, making it world‑writable on shared systems. No project code runs during this process; the damage manifests as unintended configuration changes that can lead to local privilege escalation through file corruption or arbitrary local file write.

The vulnerability affects the Node Version Manager implementation maintained by nvm-sh under the vendor product nvm. All releases from 0.27.0 up to and including 0.40.8 are impacted. Versions 0.41.0 and later have removed the ability for a project .npmrc to dictate which configuration file --delete-prefix edits, eliminating the flaw.

The base CVSS score of 1.8 indicates low severity, and no EPSS data is provided. The vulnerability is not listed in CISA KEV. Based on the description, the attacker can be a local user with write access to a shared parent directory or the author of a malicious repository. This conclusion is inferred because the description describes local file write capabilities but does not explicitly state the attack vector. Exploitation requires only local file write access and does not involve code execution. The risk is limited to accidental or intentional configuration corruption or the creation of world‑writable configuration files on shared systems.