CVE-2026-121748 — nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

CVE-2026-121748 is associated with CWE-73: External Control of File Name or Path. According to the title, nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable.