CVE-2026-1665: medium-severity vulnerability in nvm-sh nvm
Command Injection in nvm via NVM_AUTH_HEADER in wget code path
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.8%
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
nvm-sh · nvmRelated CVEs — nvm-sh nvm
In the same product, most dangerous first.
CVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2026-15921LOWnvm path traversal via a malicious mirror's LTS codename writes outside the alias directoryEPSS 0.3%CVE-2026-94185MEDIUMnvm alias resolution follows `..` and discloses files outside $NVM_DIR/aliasEPSS 0.2%CVE-2026-118905HIGHnvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sedEPSS 0.1%