CVE-2026-121751

A flaw was found in Node Version Manager nvm. Remote version data retrieved from a mirror is stored without sufficient validation and later evaluated during shell arithmetic operations. An attacker controlling a malicious or compromised mirror can provide crafted version strings that trigger...

CVE-2026-121751 nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVMDIR/alias/lts/ without validating it,...

CVE-2026-121751

Node Version Manager (nvm) versions 0.39.6 through 0.40.8 are vulnerable to OS command injection via shell arithmetic evaluation. The nvm ls-remote command stores unvalidated version strings from a mirror's index.tab into $NVM_DIR/alias/lts/. Subsequently, nvm_normalize_lts evaluates these string...

PT-2026-137193

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.39.6 through 0.40.8 Description An issue exists where nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVM DIR/alias/lts/ without...