Command Injection Vulnerability in Node Version Manager by NVM

CVE-2026-1665

What is CVE-2026-1665?

A command injection vulnerability exists in Node Version Manager (NVM) versions 0.40.3 and earlier. This issue arises from the nvm_download() function, which uses eval to execute wget commands without properly sanitizing the NVM_AUTH_HEADER environment variable. As a result, an attacker can exploit this vulnerability by setting malicious environment variables in a user's shell environment—possibly through compromised CI/CD configurations or Docker images. When victims run NVM commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote', arbitrary shell commands can be executed, leading to potential unauthorized actions in the victim's system.

References