friman

friman Do you ever feel that finding the right Frida version for the job is like threading a needle? With different projects, devices, and debugging scenarios all requiring specific builds, keeping track of Frida versions can quickly become a tedious balancing act. friman pronounced "free man " i...

CVE-2026-121746

A flaw was found in Node Version Manager nvm. When saving a version configuration, nvm follows symbolic links without verifying whether the target file resides outside the working directory. By convincing a user to execute save commands within a malicious repository containing a crafted symbolic...

CVE-2026-121747

A flaw was found in Node Version Manager nvm. This flaw allows information disclosure when processing a repository or archive containing a configuration file .nvmrc that is a symbolic link pointing to sensitive files on the system. When a user or automated continuous integration CI build system...

CVE-2026-121751

A flaw was found in Node Version Manager nvm. Remote version data retrieved from a mirror is stored without sufficient validation and later evaluated during shell arithmetic operations. An attacker controlling a malicious or compromised mirror can provide crafted version strings that trigger...

CVE-2026-121751

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVMDIR/alias/lts/ without validating it,...

CVE-2026-121746

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save or -w write the resolved version to $PWD/.nvmrc with tee, which follows a symbolic link. A repository that commits .nvmrc a...

CVE-2026-121747

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file for example ../../.npmrc, or...

CVE-2026-121748

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

CVE-2026-121749

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to grep as a bare argument, without -e, in nvmlsremoteindextab, nvmremoteversion, and nvmlscached. A .nvmrc whose first li...

CVE-2026-121750

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, nvmdownloadartifact downloads a release archive directly to its final path in $NVMDIR/.cache and verifies its checksum afterwards; on a checksum mismatch it...

CVE-2026-121745

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVMAUTHHEADER is set, nvmdownload passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are...

CVE-2026-121749

Node Version Manager (nvm ) versions 0.5.0 through 0.40.8 are vulnerable to argument injection in the nvm_ls_remote_index_tab, nvm_remote_version, and nvm_ls_cached functions. The software passes version patterns to grep without the -e flag, allowing a malicious .nvmrc file to inject options. For...

CVE-2026-121748 nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

CVE-2026-121745

The Node Version Manager (nvm) versions 0.40.0 through 0.40.8 are vulnerable to a local information disclosure flaw. When the NVM_AUTH_HEADER environment variable is set, the nvm_download function passes the credential as a command-line argument to curl or wget. Because process arguments are visi...

CVE-2026-121745

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when "NVMAUTHHEADER" is set, "nvmdownload" passes the credential to curl or wget as a "--header "Authorization: ..."" command-line argument. Process arguments ar...

PT-2026-137187

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.40.0 through 0.40.8 Description When the NVM AUTH HEADER variable is set, the nvm download function passes credentials to curl or wget as a command-line argument. Because process arguments are visible to all...

CVE-2026-121748: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

PT-2026-137188

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.40.0 through 0.40.8 Description When using the nvm use --save and nvm install --save or -w commands, the software writes the resolved version to the .nvmrc file using tee, which follows symbolic links. If a...

PT-2026-137191

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.5.0 through 0.40.8 Description In the nvm ls remote index tab, nvm remote version, and nvm ls cached functions, the requested version pattern is passed to grep as a bare argument without the -e flag. A .nvmr...

PT-2026-137189

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.2.0 through 0.40.8 Description Node Version Manager nvm fails to verify if the .nvmrc file is a symbolic link. An attacker can provide a repository or archive containing a .nvmrc file that symlinks to...