Jordan Harband

**Name of the Vulnerable Software and Affected Versions** Node Version Manager (nvm) versions 0.32.1 through 0.40.5 **Description** An issue exists where `nvm ls-remote` and other commands that refresh remote LTS aliases, such as `nvm install --lts`, parse the node.js mirror's `index.tab` and use the LTS codename field as an alias filename without validation. A compromised mirror or a man-in-the-middle attack can return an LTS codename containing path-traversal sequences, such as `../../../.bashrc`. This allows the software to write version strings to paths outside the `$NVM DIR/alias` directory. In default configurations where `$NVM DIR` is `~/.nvm`, this can result in the creation or overwriting of files in the user's home directory, including shell startup files, potentially leading to code execution in subsequent shell sessions. Exploitation requires the use of a hostile mirror via a compromised CDN, network man-in-the-middle, or a malicious configuration of the `NVM NODEJS ORG MIRROR` or `NVM IOJS ORG MIRROR` variables. **Recommendations** Update to version 0.40.6.

**Name of the Vulnerable Software and Affected Versions** shell-quote versions prior to 1.8.4 **Description** The `quote()` function fails to validate object-token inputs against the operator model used by `parse()`. Specifically, the `.op` field is escaped using a regular expression that does not match line terminators such as ` `, `r`, `U+2028`, and `U+2029`. This allows line terminators to pass unescaped into the output. Since POSIX shells treat literal newlines as command separators, any content following the newline is executed as a separate command, leading to command injection. This issue is reachable through the direct construction of `{ op: '... ...' }` from external input or via `parse(cmd, envFn)` when `envFn` returns object tokens with an attacker-influenced `.op` field. **Recommendations** Update to version 1.8.4 or later. As a temporary workaround, restrict external input from influencing the `.op` field in object tokens passed to the `quote()` function or returned by `envFn` in the `parse()` function.

**Name of the Vulnerable Software and Affected Versions** Lodash versions 4.0.0 through 4.17.22 **Description** Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the ` .unset` and ` .omit` functions. An attacker can leverage crafted paths to trigger the deletion of methods from global prototypes. The issue allows for property deletion but does not permit modification of the original behavior of those properties. **Recommendations** Update to Lodash version 4.17.23 or later.