Skip to content
OpenAdvisories

Vendor

nvm-sh

12 known vulnerabilities.

Products

nvm 12
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.0
    CVE-2026-118905

    nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed

    Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, e…

    nvm-sh nvm
  • High 7.5
    CVE-2026-10796

    nvm executes commands from a malicious Node.js mirror's version strings

    nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, wi…

    nvm-sh nvm