CVE-2026-121748

A flaw was found in Node Version Manager nvm. When executing the prefix deletion command, nvm invokes the package manager without specifying a target configuration file, allowing settings from an untrusted project configuration to designate which file is edited. An attacker who convinces a user t...

CVE-2026-121750

A flaw was found in Node Version Manager nvm. When downloading release archives, nvm stores the file directly in the local cache before performing checksum verification, leaving rejected archives in place when a checksum mismatch occurs. If a user subsequently attempts an offline installation for...

CVE-2026-121745

A flaw was found in Node Version Manager nvm. When downloading files or querying remote resources using custom authentication headers, authorization credentials are passed directly as command-line arguments to external download utilities. A local attacker on a shared system can observe running...

CVE-2026-121746

A flaw was found in Node Version Manager nvm. When saving a version configuration, nvm follows symbolic links without verifying whether the target file resides outside the working directory. By convincing a user to execute save commands within a malicious repository containing a crafted symbolic...

CVE-2026-121747

A flaw was found in Node Version Manager nvm. This flaw allows information disclosure when processing a repository or archive containing a configuration file .nvmrc that is a symbolic link pointing to sensitive files on the system. When a user or automated continuous integration CI build system...

CVE-2026-121751

A flaw was found in Node Version Manager nvm. Remote version data retrieved from a mirror is stored without sufficient validation and later evaluated during shell arithmetic operations. An attacker controlling a malicious or compromised mirror can provide crafted version strings that trigger...

CVE-2026-121751

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVMDIR/alias/lts/ without validating it,...

CVE-2026-121746

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, nvm use --save and nvm install --save or -w write the resolved version to $PWD/.nvmrc with tee, which follows a symbolic link. A repository that commits .nvmrc a...

CVE-2026-121747

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether .nvmrc is a symbolic link. A repository or archive that ships .nvmrc as a symlink to another file for example ../../.npmrc, or...

CVE-2026-121749

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to grep as a bare argument, without -e, in nvmlsremoteindextab, nvmremoteversion, and nvmlscached. A .nvmrc whose first li...

CVE-2026-121748

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

CVE-2026-121750

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, nvmdownloadartifact downloads a release archive directly to its final path in $NVMDIR/.cache and verifies its checksum afterwards; on a checksum mismatch it...

CVE-2026-121745

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVMAUTHHEADER is set, nvmdownload passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are...

CVE-2026-121749 nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to grep as a bare argument, without -e, in nvmlsremoteindextab, nvmremoteversion, and nvmlscached. A .nvmrc whose first li...

CVE-2026-121749

Node Version Manager (nvm ) versions 0.5.0 through 0.40.8 are vulnerable to argument injection in the nvm_ls_remote_index_tab, nvm_remote_version, and nvm_ls_cached functions. The software passes version patterns to grep without the -e flag, allowing a malicious .nvmrc file to inject options. For...

CVE-2026-121748 nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

CVE-2026-121748 nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's .npmrc sets prefix, nvm use tells the user to run nvm use --delete-prefix, which runs npm config delete prefix and npm config delete globalconfi...

CVE-2026-121745 nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVMAUTHHEADER is set, nvmdownload passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are...

CVE-2026-121745

The Node Version Manager (nvm) versions 0.40.0 through 0.40.8 are vulnerable to a local information disclosure flaw. When the NVM_AUTH_HEADER environment variable is set, the nvm_download function passes the credential as a command-line argument to curl or wget. Because process arguments are visi...

CVE-2026-121745

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when "NVMAUTHHEADER" is set, "nvmdownload" passes the credential to curl or wget as a "--header "Authorization: ..."" command-line argument. Process arguments ar...