CVE-2026-1665: falha de média gravidade em nvm-sh nvm
Command Injection in nvm via NVM_AUTH_HEADER in wget code path
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.8%
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
nvm-sh · nvmCVEs relacionadas — nvm-sh nvm
No mesmo produto, das mais perigosas para as menos.
CVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2026-15921LOWnvm path traversal via a malicious mirror's LTS codename writes outside the alias directoryEPSS 0.3%CVE-2026-121751LOWnvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliasesEPSS 0.2%CVE-2026-94185MEDIUMnvm alias resolution follows `..` and discloses files outside $NVM_DIR/aliasEPSS 0.2%CVE-2026-121747MEDIUMnvm prints the contents of any readable file through a symlinked .nvmrcEPSS 0.2%CVE-2026-121746MEDIUMnvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can writeEPSS 0.2%