RCE in Nvm-Sh Nvm
CVE-2026-1665
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.008 (55.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: -0.000
Affected products
- Nvm-Sh Nvm — versions 0.40.0, 0.40.4
Weakness classification (CWE)
References
- Fix commit (patch)
- Release v0.40.4 (release-notes)
- nvm GitHub repository (product)
- ce714d77-add3-4f53-aff5-83d477b104bb (x_introduced)