nvm prints the contents of any readable file through a symlinked .nvmrc

Overview

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file (for example ../../.npmrc, or /proc/self/environ on Linux) makes a plain nvm use, nvm install, nvm which, nvm exec, nvm run, or nvm-exec read that file and print its contents in the invalid-.nvmrc message (even with --silent) or, for a one-line file, in the Found ... with version <...> message; with the README's zsh load-nvmrc or bash cdnvm hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked .nvmrc, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash cdnvm hook, which read .nvmrc itself, now gets the version from nvm, so users of that hook must also update their copy of it.

Affected

• nvm >= 0.2.0 < 0.41.0

Remediation

Upgrade to nvm 0.41.0 or later.

Workarounds

Until upgrading, check for a symlinked .nvmrc (ls -l .nvmrc) before running nvm in an untrusted project directory, and do not run nvm in CI for untrusted branches where its output is visible to their authors.