Executive brief
nvm (Node Version Manager) is a tool used by developers to install and manage different versions of Node.js. A vulnerability exists where nvm fails to properly check version information provided by download mirrors. If a user is tricked into using a malicious mirror or if their connection to a mirror is intercepted, an attacker can execute arbitrary commands on the user's computer with the user's full permissions. This could lead to total system compromise, data theft, or the installation of malware. The default official mirror is not affected.
Technical details
nvm through 0.40.4 contains two command injection sinks fed by untrusted version strings retrieved from a mirror's index.tab file. The first sink, in nvm_download(), uses 'eval' to execute a constructed curl/wget command string where the version-derived URL is not properly sanitized against command substitution (e.g., $(id)). The second sink, in nvm_get_checksum(), interpolates the version-derived download slug directly into an awk program string, allowing an attacker to break out of the awk context and execute commands via awk's system() function. An attacker controlling a mirror or performing a Man-in-the-Middle (MitM) attack on a non-TLS mirror can achieve remote code execution with the privileges of the user running nvm. The issue is fixed in the master branch (and version 0.40.5) by removing 'eval' usage, passing awk variables via -v, and implementing strict version string validation.
Affected products
- nvm-sh nvm (Node Version Manager) <= 0.40.4
Timeline
- 2026-06-02: patched: Fixes committed to master branch
- 2026-06-04: disclosed: Vulnerability published via GHSA and NVD
References
- https://github.com/nvm-sh/nvm/commit/6d870d182cd5333647ffa16c0d7dbcd817ec27a8
- https://github.com/nvm-sh/nvm/commit/70fb4ede6b9731d75d86451d48caa5faffbec21c
- https://github.com/nvm-sh/nvm/commit/90bb88748ba6c29c2cec73b18ed7057413aef308
- https://github.com/nvm-sh/nvm/security/advisories/GHSA-3c52-35h2-gfmm