Vulnerabilidades em nvm-sh
12 resultadosAnálise Vexday
O nvm-sh apresenta 3 vulnerabilidades registradas, com 2 publicadas nos últimos 90 dias, indicando risco recente. Nenhuma está sob exploração ativa (KEV) e não há críticas de severidade máxima, mas a fraqueza dominante é CWE-78 (command injection), que pode permitir execução de código em contextos sensíveis. O perfil sugere exposição moderada que demanda monitoramento contínuo, especialmente considerando a natureza do projeto como gerenciador de versões Node.
CVE-2026-10796HIGHnvm executes commands from a malicious Node.js mirror's version stringsEPSS 5.0%CVE-2026-1665MEDIUMCommand Injection in nvm via NVM_AUTH_HEADER in wget code pathEPSS 0.8%CVE-2026-15921LOWnvm path traversal via a malicious mirror's LTS codename writes outside the alias directoryEPSS 0.3%CVE-2026-121751LOWnvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliasesEPSS 0.2%CVE-2026-94185MEDIUMnvm alias resolution follows `..` and discloses files outside $NVM_DIR/aliasEPSS 0.2%CVE-2026-121747MEDIUMnvm prints the contents of any readable file through a symlinked .nvmrcEPSS 0.2%CVE-2026-121746MEDIUMnvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can writeEPSS 0.2%CVE-2026-121749MEDIUMnvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local filesEPSS 0.2%CVE-2026-121750LOWnvm install --offline installs a cached tarball that previously failed checksum verificationEPSS 0.1%CVE-2026-118905HIGHnvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sedEPSS 0.1%CVE-2026-121748LOWnvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writableEPSS 0.1%CVE-2026-121745LOWnvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command lineEPSS 0.1%