Potential Code Execution Vulnerability in Node Version Manager by NVM
CVE-2026-121750

2.1LOW

Key Information:

Vendor

Nvm-sh

Status
Nvm
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121750?

A vulnerability exists in Node Version Manager (NVM) versions 0.40.5 to 0.40.8, where the function nvm_download_artifact allows an attacker to execute arbitrary code. When NVM downloads a release archive, it does so directly to the cache directory without validating the integrity of the file until after the download is complete. If a checksum mismatch occurs, the error is reported, but the invalid file remains in the cache. If a user subsequently attempts to install NVM offline using the same version, the application may use this compromised file, leading to unauthorized code execution. The issue highlights the importance of thorough checksum validation before utilizing downloaded files.

Affected Version(s)

nvm 0.40.5 < 0.41.0

References

https://github.com/nvm-sh/nvm/security/advisories/GHSA-26...
vendor-advisory
https://github.com/nvm-sh/nvm/commit/1f99e4c20bb92c5737b9...
patch

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic's OSS Scanner, as vulnerability ANT-2026-7NCT51FE
Jordan Harband (https://github.com/ljharb)
.