nvm-sh vulnerabilities

Newest CVEs

• CVE-2026-121746

  nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write

  nvm-sh · nvm

  Medium6.7
• CVE-2026-121749

  nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files

  nvm-sh · nvm

  Medium4.6
• CVE-2026-121747

  nvm prints the contents of any readable file through a symlinked .nvmrc

  nvm-sh · nvm

  Medium6.7
• CVE-2026-121748

  nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable

  nvm-sh · nvm

  Low1.8
• CVE-2026-121750

  nvm install --offline installs a cached tarball that previously failed checksum verification

  nvm-sh · nvm

  Low2.1
• CVE-2026-121745

  nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

  nvm-sh · nvm

  Low2.0
• CVE-2026-121751

  nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

  nvm-sh · nvm

  Low2.1
• CVE-2026-118905

  nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed

  nvm-sh · nvm

  High7.1
• CVE-2026-94185

  nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

  nvm-sh · nvm

  Medium6.7
• CVE-2026-15921

  nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory

  nvm-sh · nvm

  Low2.1