Nvm-sh vulnerabilities

Products

• Nvm 12

Newest

• nvm-sh nvm nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write CVE-2026-121746 6.7 MediumNovember 4, 2026
• nvm-sh nvm nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files CVE-2026-121749 4.6 MediumNovember 4, 2026
• nvm-sh nvm nvm prints the contents of any readable file through a symlinked .nvmrc CVE-2026-121747 6.7 MediumNovember 4, 2026
• nvm-sh nvm nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable CVE-2026-121748 1.8 LowNovember 4, 2026
• nvm-sh nvm nvm install --offline installs a cached tarball that previously failed checksum verification CVE-2026-121750 2.1 LowNovember 4, 2026
• nvm-sh nvm nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line CVE-2026-121745 2.0 LowNovember 4, 2026
• nvm-sh nvm nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases CVE-2026-121751 2.1 LowNovember 4, 2026
• nvm-sh nvm nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed CVE-2026-118905 7.1 HighOctober 29, 2026
• nvm-sh nvm nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVE-2026-94185 6.7 MediumSeptember 21, 2026
• nvm-sh nvm nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVE-2026-15921 2.1 LowJuly 15, 2026
• nvm-sh nvm, openjsf node version manager +1 more nvm executes commands from a malicious Node.js mirror's version strings CVE-2026-10796 7.5 HighJune 4, 2026
• nvm-sh nvm Command Injection in nvm via NVM_AUTH_HEADER in wget code path CVE-2026-1665 5.4 MediumJanuary 29, 2026