CVE-2026-121745

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121745", "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "state": "PUBLISHED", "assignerShortName": "harborist", "dateReserved": "2026-11-03T23:38:59.223Z", "datePublished": "2026-11-04T21:28:03.234Z", "dateUpdated": "2026-11-09T20:49:04.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "shortName": "harborist", "dateUpdated": "2026-11-04T21:28:03.234Z"}, "title": "nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-214", "description": "CWE-214 Invocation of Process Using Visible Sensitive Information", "type": "CWE"}]}], "affected": [{"vendor": "nvm-sh", "product": "nvm", "repo": "https://github.com/nvm-sh/nvm", "versions": [{"status": "affected", "version": "0.40.0", "lessThan": "0.41.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.</p>"}]}], "references": [{"url": "https://github.com/nvm-sh/nvm/security/advisories/GHSA-h3c2-g6gc-6cgx", "name": "GHSA-h3c2-g6gc-6cgx", "tags": ["vendor-advisory"]}, {"url": "https://github.com/nvm-sh/nvm/commit/903e3493699399d049f3af445c2d81688b6a7f5c", "name": "Fix commit 903e3493", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "workarounds": [{"lang": "en", "value": "Until upgrading, do not set `NVM_AUTH_HEADER` on machines shared with other local users, or mount `/proc` with `hidepid=2` on Linux.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Until upgrading, do not set `NVM_AUTH_HEADER` on machines shared with other local users, or mount `/proc` with `hidepid=2` on Linux.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an argument).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an argument).</p>"}]}], "credits": [{"lang": "en", "value": "Anthropic's OSS Scanner, as vulnerability ANT-2026-540RL2U6", "type": "finder"}, {"lang": "en", "value": "Jordan Harband (https://github.com/ljharb)", "type": "remediation developer"}], "source": {"advisory": "GHSA-h3c2-g6gc-6cgx", "discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T20:47:31.708852Z", "id": "CVE-2026-121745", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:49:04.757Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T20:47:31.708852Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:48:00.571Z"}}], "cna": {"title": "nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line", "source": {"advisory": "GHSA-h3c2-g6gc-6cgx", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Anthropic's OSS Scanner, as vulnerability ANT-2026-540RL2U6"}, {"lang": "en", "type": "remediation developer", "value": "Jordan Harband (https://github.com/ljharb)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/nvm-sh/nvm", "vendor": "nvm-sh", "product": "nvm", "versions": [{"status": "affected", "version": "0.40.0", "lessThan": "0.41.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an argument).", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an argument).</p>", "base64": false}]}], "references": [{"url": "https://github.com/nvm-sh/nvm/security/advisories/GHSA-h3c2-g6gc-6cgx", "name": "GHSA-h3c2-g6gc-6cgx", "tags": ["vendor-advisory"]}, {"url": "https://github.com/nvm-sh/nvm/commit/903e3493699399d049f3af445c2d81688b6a7f5c", "name": "Fix commit 903e3493", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Until upgrading, do not set `NVM_AUTH_HEADER` on machines shared with other local users, or mount `/proc` with `hidepid=2` on Linux.", "supportingMedia": [{"type": "text/html", "value": "<p>Until upgrading, do not set `NVM_AUTH_HEADER` on machines shared with other local users, or mount `/proc` with `hidepid=2` on Linux.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.", "supportingMedia": [{"type": "text/html", "value": "<p>Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-214", "description": "CWE-214 Invocation of Process Using Visible Sensitive Information"}]}], "providerMetadata": {"orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "shortName": "harborist", "dateUpdated": "2026-11-04T21:28:03.234Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121745", "state": "PUBLISHED", "dateUpdated": "2026-11-09T20:49:04.757Z", "dateReserved": "2026-11-03T23:38:59.223Z", "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "datePublished": "2026-11-04T21:28:03.234Z", "assignerShortName": "harborist"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "nvm", "repo": "https://github.com/nvm-sh/nvm", "vendor": "nvm-sh", "versions": [{"lessThan": "0.41.0", "status": "affected", "version": "0.40.0", "versionType": "semver"}]}], "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument."}], "id": "CVE-2026-121745", "lastModified": "2026-11-10T21:46:30.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121745", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T20:47:31.708852Z", "version": "2.0.3"}}]}, "published": "2026-11-04T22:17:53.970", "references": [{"source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "url": "https://github.com/nvm-sh/nvm/commit/903e3493699399d049f3af445c2d81688b6a7f5c"}, {"source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "url": "https://github.com/nvm-sh/nvm/security/advisories/GHSA-h3c2-g6gc-6cgx"}], "sourceIdentifier": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-214"}], "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "type": "Secondary"}]}

{"bugzilla": {"description": "nvm: nvm: Information disclosure via command-line credential exposure", "id": "2567606", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567606"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-214", "details": ["Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header \"Authorization: ...\"` command-line argument. Process arguments are visible to every local user (on Linux via `ps` or `/proc//cmdline` unless `/proc` is mounted with `hidepid=`; on macOS via `ps`), so another unprivileged account on the same machine can read the token while nvm is downloading during `nvm ls-remote`, `nvm install`, and similar commands, and gain whatever access it grants on the private mirror. Only users who set `NVM_AUTH_HEADER` on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.", "A flaw was found in Node Version Manager (nvm). When downloading files or querying remote resources using custom authentication headers, authorization credentials are passed directly as command-line arguments to external download utilities. A local attacker on a shared system can observe running process arguments, leading to information disclosure of sensitive authentication tokens."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-121745", "public_date": "2026-11-04T21:28:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121745\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121745\nhttps://github.com/nvm-sh/nvm/commit/903e3493699399d049f3af445c2d81688b6a7f5c\nhttps://github.com/nvm-sh/nvm/security/advisories/GHSA-h3c2-g6gc-6cgx"], "statement": "This vulnerability is rated as Low severity because successful credential exposure requires an unprivileged local attacker to inspect process tables during a transient execution window, and it solely affects systems configured with custom authentication headers for private mirrors. Red Hat products do not distribute Node Version Manager by default, limiting potential exposure to user-managed developer environments where multi-tenant access is uncommon. Additionally, the flaw is restricted to local token disclosure and does not compromise system availability or integrity.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.40.0,0.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nvm", "source": "cna", "vendor": "nvm-sh"}, "product": "nvm", "vendor": "nvm-sh"}], "created": "2026-11-04T22:45:14.986359+00:00", "updated": "2026-11-04T23:00:21.131087+00:00", "vendors": ["nvm-sh", "nvm-sh$PRODUCT$nvm"]}