CVE-2026-121745

The Node Version Manager (nvm) versions 0.40.0 through 0.40.8 are vulnerable to a local information disclosure flaw. When the NVM_AUTH_HEADER environment variable is set, the nvm_download function passes the credential as a command-line argument to curl or wget. Because process arguments are visi...

CVE-2026-10796

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as "nvm install" read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download UR...

CVE-2026-10796: Improper Neutralization of Special Elements used in an OS Command

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-1665

A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...

CVE-2026-1665: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in nvm Node Version Manager versions 0.40.3 and below. The nvmdownload function uses eval to execute wget commands, and the NVMAUTHHEADER environment variable was not sanitized in the wget code path though it was sanitized in the curl code path. An attacke...