PT-2026-5371 · Nvm · Nvm

Jiyong Yang · Published 2024-06-21 · Updated 2026-01-30 · CVE-2026-1665

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nvm versions 0.40.3 and below

Description A command injection issue exists in nvm (Node Version Manager). The nvm download() function utilizes eval to execute wget commands. The NVM AUTH HEADER environment variable was not properly sanitized when used in the wget code path. An attacker capable of setting environment variables within a victim’s shell environment—for example, through malicious CI/CD configurations, compromised dotfiles, or Docker images—can inject arbitrary shell commands. These commands will execute when the victim runs nvm commands that initiate downloads, such as 'nvm install' or 'nvm ls-remote'.

Recommendations Update nvm to a version newer than 0.40.3.

Fix

Eval Injection

OS Command Injection

Weakness Enumeration

CWE-95

CWE-78

Related Identifiers

BDU:2026-04854

CVE-2026-1665

Affected Products

Nvm

References · 11

• https://github.com/nvm-sh/nvm/commit/44e2590cdf257faf7d885e4470be8dc66cec9506 · Patch
• https://bdu.fstec.ru/vul/2026-04854 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-1665 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1665 · Vendor Advisory
• https://github.com/nvm-sh/nvm/pull/3380 · Note
• https://github.com/nvm-sh/nvm/releases/tag/v0.40.4 · Note
• https://github.com/nvm-sh/nvm · Note
• https://t.me/cveNotify/150336 · Telegram Post
• https://twitter.com/CVEnew/status/2017024590124630086 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017055131850690875 · Twitter Post
• https://t.me/CVEtracker/43262 · Telegram Post