CVE-2026-10796

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as "nvm install" read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download UR...

CVE-2026-10796: Improper Neutralization of Special Elements used in an OS Command

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...