CVE-2026-121749

Node Version Manager (nvm ) versions 0.5.0 through 0.40.8 are vulnerable to argument injection in the nvm_ls_remote_index_tab, nvm_remote_version, and nvm_ls_cached functions. The software passes version patterns to grep without the -e flag, allowing a malicious .nvmrc file to inject options. For...