60 matches found
Node Version Manager 安全漏洞
Node Version Manager is an open-source node version manager developed by nvm.sh. Versions of Node Version Manager prior to 0.40.4 contain security vulnerabilities. These vulnerabilities stem from the ability to execute arbitrary commands from the configured image version string. The functions...
CVE-2026-10796: Improper Neutralization of Special Elements used in an OS Command
nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...
nvm_download() Command Execution
The vulnerability of the nvmdownload function in the Node.js Node Version Manager nvm lies in the improper elimination of special elements during the processing of the NVMAUTHHEADER variable. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2026-1665
A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...
CVE-2026-1665
A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...
CVE-2026-1665 Command Injection in nvm via NVM_AUTH_HEADER in wget code path
A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...
CVE-2026-1665 Command Injection in nvm via NVM_AUTH_HEADER in wget code path
A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...
EUVD-2026-5014
A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...
CVE-2026-1665 Command Injection in nvm via NVM_AUTH_HEADER in wget code path
A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...
CVE-2026-1665
CVE-2026-1665 affects nvm (Node Version Manager) versions 0.40.3 and earlier. The vulnerability arises because the wget path in the nvm_download() function uses eval to execute commands and the NVM_AUTH_HEADER environment variable is not sanitized in that path (unlike the curl path). An attacker ...
Node Version Manager security vulnerability
Node Version Manager is an open-source node version manager developed by nvm.sh. Versions of Node Version Manager prior to 0.40.3 contain security vulnerabilities. These vulnerabilities stem from the nvmdownload function using eval to execute the wget command, and the NVMAUTHHEADER environment...
PT-2026-5371
Name of the Vulnerable Software and Affected Versions nvm versions 0.40.3 and below Description A command injection issue exists in nvm Node Version Manager. The nvm download function utilizes eval to execute wget commands. The NVM AUTH HEADER environment variable was not properly sanitized when...
CVE-2025-65656
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php...
EUVD-2025-200278
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php...
CVE-2025-65656
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php...
CVE-2025-65656
The dcat-admin package (v2.2.3-beta and before) is vulnerable to file inclusion within the admin/src/Extend/VersionManager.php component. The root cause is an Unsafe Dependency Resolution during the extension upload process, where an attacker can supply crafted input to the file inclusion mechani...
CVE-2025-65656
dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php...
dcat-admin 安全漏洞
dcat-admin is a Laravel-based back-end system builder by Jiang Qinghua, an individual developer. A security vulnerability exists in dcat-admin v2.2.3-beta and earlier versions, which originates from admin/src/Extend/VersionManager.php being vulnerable to file inclusion attacks...