RCE in Nvm-sh Nvm
CVE-2026-1665
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget co…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.008 (51.5th percentile) — read the EPSS interpretation.
Affected products
- Nvm-sh Nvm — versions 0.40.0, 0.40.4
Weakness classification (CWE)
References
- ce714d77-add3-4f53-aff5-83d477b104bb (patch)
- ce714d77-add3-4f53-aff5-83d477b104bb (release-notes)
- ce714d77-add3-4f53-aff5-83d477b104bb (product)
- ce714d77-add3-4f53-aff5-83d477b104bb (x_introduced)