Vulnerabilities in nvm-sh
12 resultsCVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2026-1665MEDIUMCommand Injection in nvm via NVM_AUTH_HEADER in wget code pathEPSS 0.8%CVE-2026-15921LOWnvm path traversal via a malicious mirror's LTS codename writes outside the alias directoryEPSS 0.3%CVE-2026-121751LOWnvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliasesEPSS 0.2%CVE-2026-94185MEDIUMnvm alias resolution follows `..` and discloses files outside $NVM_DIR/aliasEPSS 0.2%CVE-2026-121747MEDIUMnvm prints the contents of any readable file through a symlinked .nvmrcEPSS 0.2%CVE-2026-121746MEDIUMnvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can writeEPSS 0.2%CVE-2026-121749MEDIUMnvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local filesEPSS 0.2%CVE-2026-121750LOWnvm install --offline installs a cached tarball that previously failed checksum verificationEPSS 0.1%CVE-2026-118905HIGHnvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sedEPSS 0.1%CVE-2026-121748LOWnvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writableEPSS 0.1%CVE-2026-121745LOWnvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command lineEPSS 0.1%