PT-2026-46295 · Nvm · Nvm
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
nvm versions prior to 0.40.5
Description
Command injection occurs when the software executes arbitrary commands from version strings provided by a configured Node.js/io.js mirror. When commands like
nvm install read available versions from the mirror's index.tab, the selected version is used without sanitization to build download URLs and shell/awk commands. Two specific sinks are affected: the nvm download() function builds a curl/wget command string and executes it using eval, allowing command substitution (e.g., $(id)) to be run by the local shell; the nvm get checksum() function interpolates the version-derived download slug into an awk program, allowing arbitrary commands to be executed via awk's system() function. An attacker controlling the mirror, providing content to a user or CI on a non-default mirror, or performing a machine-in-the-middle attack on a non-TLS mirror can execute commands with the privileges of the user running the software.Recommendations
Update to a version later than 0.40.4.
Use the default HTTPS mirror (https://nodejs.org) to minimize the risk of exploitation.
Exploit
Fix
RCE
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nvm