Shell command injection in Node Version Manager by nvm

CVE-2026-118905

What is CVE-2026-118905?

A vulnerability in Node Version Manager (nvm) allows attackers to execute shell commands through a crafted version string, particularly when the nvm_ls function processes input. The flaw arises as version patterns containing special characters can inadvertently terminate the sed command address, with subsequent input being treated as sed commands instead. This exploitation method can occur whenever a maliciously influenced version string is used in nvm commands. Users of specific auto-switch hooks that read .nvmrc files are at risk, allowing attackers to run arbitrary commands merely by navigating into directories containing compromised .nvmrc files. Version 0.40.6 mitigates this by improving input handling, ensuring that potentially dangerous characters are not processed by the securing commands.

References