Vendor
nvm-sh
12 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Low 3.3
nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remote_index_tab`, `nvm_rem…
-
Low 3.6
nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.27.0 through 0.40.8, when a project's `.npmrc` sets `prefix`, `nvm use` tells the user to run `nvm use --delete-prefix`, which runs `npm confi…
-
Low 3.1
nvm install --offline installs a cached tarball that previously failed checksum verification
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its chec…
-
Low 2.5
nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when `NVM_AUTH_HEADER` is set, `nvm_download` passes the credential to curl or wget as a `--header "Authorization: ..."` …
-
Low 3.1
nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab`…
-
Low 3.1
nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and other commands that refresh remote LTS aliases, such as `nvm install --lts`) parse the node.js mirro…