CVE-2026-121751

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote (and other commands that refresh remote LTS aliases) store the version column of the mirror's index.tab in $NVM_DIR/alias/lts/ without validating it, and nvm_normalize_lts later evaluates any suffix of an lts/-N value inside shell arithmetic $((N+1)). Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as lts/-10*path[$(cmd)1] runs cmd as the user when the alias is later resolved by purely local commands (nvm ls, nvm alias, nvm use --lts, nvm which lts/), and in every new shell when the default alias is lts/*. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an http:// mirror, or a maliciously configured NVM_NODEJS_ORG_MIRROR -- and to run an affected command. The same sink is also reachable from a project .nvmrc, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit lts/-N offset to arithmetic and drops index.tab rows whose version is not a valid version string.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote (and other commands that refresh remote LTS aliases) store the version column of the mirror's index.tab in $NVM_DIR/alias/lts/ without validating it, and nvm_normalize_lts later evaluates any suffix of an lts/-N value inside shell arithmetic $((N+1)). Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as lts/-10*path[$(cmd)1] runs cmd as the user when the alias is later resolved by purely local commands (nvm ls, nvm alias, nvm use --lts, nvm which lts/), and in every new shell when the default alias is lts/*. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an http:// mirror, or a maliciously configured NVM_NODEJS_ORG_MIRROR -- and to run an affected command. The same sink is also reachable from a project .nvmrc, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit lts/-N offset to arithmetic and drops index.tab rows whose version is not a valid version string.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote (and other commands that refresh remote LTS aliases) store the version column of the mirror's index.tab in $NVM_DIR/alias/lts/ without validating it, and nvm_normalize_lts later evaluates any suffix of an lts/-N value inside shell arithmetic $((N+1)). Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as lts/-10*path[$(cmd)1] runs cmd as the user when the alias is later resolved by purely local commands (nvm ls, nvm alias, nvm use --lts, nvm which lts/), and in every new shell when the default alias is lts/*. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an http:// mirror, or a maliciously configured NVM_NODEJS_ORG_MIRROR -- and to run an affected command. The same sink is also reachable from a project .nvmrc, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit lts/-N offset to arithmetic and drops index.tab rows whose version is not a valid version string.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote (and other commands that refresh remote LTS aliases) store the version column of the mirror's index.tab in $NVM_DIR/alias/lts/ without validating it, and nvm_normalize_lts later evaluates any suffix of an lts/-N value inside shell arithmetic $((N+1)). Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as lts/-10*path[$(cmd)1] runs cmd as the user when the alias is later resolved by purely local commands (nvm ls, nvm alias, nvm use --lts, nvm which lts/), and in every new shell when the default alias is lts/*. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an http:// mirror, or a maliciously configured NVM_NODEJS_ORG_MIRROR -- and to run an affected command. The same sink is also reachable from a project .nvmrc, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit lts/-N offset to arithmetic and drops index.tab rows whose version is not a valid version string.