# CVE-2026-118905: Node Version Manager (nvm) command injection via sed address escape

Source: https://junglewise.ai/threats/cve-2026-118905-node-version-manager-nvm-is-a-posix-compliant-shell-function-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-118905 · Severity: high · CVSS 7 · Published 2026-10-29

Node Version Manager (nvm) is a shell tool for managing multiple Node.js versions on a system. Versions 0.31.2 through 0.40.5 contain a command injection vulnerability where specially crafted version strings can execute arbitrary shell commands. An attacker can exploit this by creating a malicious `.nvmrc` file in a directory; when a developer with auto-switching enabled enters that directory, the attacker's commands run automatically with that developer's privileges.

Vendors: [Nvm-Sh](https://junglewise.ai/threats/vendors/nvm-sh).

## Quick answers

**Is CVE-2026-118905 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118905 being exploited in the wild.

**How severe is CVE-2026-118905?** High severity, with a CVSS score of 7, published 29 October 2026.

**Which products and versions are affected?** Nvm-Sh Node Version Manager (nvm) 0.31.2 through 0.40.5.

**Is there a fix for CVE-2026-118905?** Yes: fixed in 0.40.6. Until then: Disable bash `cdnvm` or zsh `load-nvmrc` auto-switching hooks if you clone or work with untrusted Git repositories, and explicitly call `nvm use` only after verifying the contents of `.nvmrc` files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118905 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-118905?** Check whether you run Nvm-Sh Node Version Manager (nvm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.40.6

Disable bash `cdnvm` or zsh `load-nvmrc` auto-switching hooks if you clone or work with untrusted Git repositories, and explicitly call `nvm use` only after verifying the contents of `.nvmrc` files.

## Technical details

The vulnerability exists in the `nvm_ls` function, which uses a sed program with the requested version pattern embedded in a `\#...#` address. Backslash characters are not escaped, allowing an attacker to close the address early and inject arbitrary sed commands (`e` in GNU sed for shell execution, `w`/`r` in BSD sed for file operations). This is reachable via `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, `nvm exec`, or `NODE_VERSION` environment variable when at least one version is installed. Auto-switch hooks in bash and zsh read `.nvmrc` files directly and pass them to vulnerable functions.

## Affected products

- nvm-sh Node Version Manager (nvm) 0.31.2 through 0.40.5

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/nvm-sh/nvm/commit/82315e2b189528a006da6701eac30e8c364ffd22](https://github.com/nvm-sh/nvm/commit/82315e2b189528a006da6701eac30e8c364ffd22)
- [https://github.com/nvm-sh/nvm/pull/3854](https://github.com/nvm-sh/nvm/pull/3854)