Is CVE-2026-15921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15921 being exploited in the wild.

How severe is CVE-2026-15921?

Low severity, with a CVSS score of 3.1, published 15 July 2026.

Which products and versions are affected?

Nvm-Sh Nvm 0.32.1 through 0.40.5.

Is there a fix for CVE-2026-15921?

A patch was published on 2026-07-15: Version 0.40.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15921 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15921?

Check whether you run Nvm-Sh Nvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15921: nvm path traversal in LTS alias creation

CVE-2026-15921 · Severity: low · CVSS 3.1 · Published 2026-07-15

Node Version Manager (nvm), a tool used by developers to manage different versions of Node.js, is vulnerable to a path traversal flaw. If a user connects to a malicious or compromised mirror server to download Node.js, the server can force nvm to overwrite sensitive files on the user's computer, such as shell startup scripts. This could allow an attacker to gain control over the user's system the next time they open a terminal session.

Technologies: Nvm-Sh Nvm. Vendors: Nvm-Sh.

Quick answers

Is CVE-2026-15921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15921 being exploited in the wild.
How severe is CVE-2026-15921?: Low severity, with a CVSS score of 3.1, published 15 July 2026.
Which products and versions are affected?: Nvm-Sh Nvm 0.32.1 through 0.40.5.
Is there a fix for CVE-2026-15921?: A patch was published on 2026-07-15: Version 0.40.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15921 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15921?: Check whether you run Nvm-Sh Nvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in nvm's `nvm_ls_remote_index_tab` function and other commands that refresh remote LTS aliases (e.g., `nvm install --lts`). The tool parses the `index.tab` file from a Node.js mirror and uses the 10th field (LTS codename) to create alias files under `$NVM_DIR/alias/lts` without sufficient validation. An attacker controlling a mirror or performing a Man-in-the-Middle (MitM) attack can supply a codename like `../../../.bashrc`, causing nvm to write the version string to the user's shell configuration file. This leads to arbitrary command execution when the user subsequently opens a new shell session. The issue is fixed in version 0.40.6 by validating LTS codenames and rejecting `..` path components.

Affected products

nvm-sh nvm 0.32.1 through 0.40.5

Timeline

2026-07-15: advisory: GitHub Security Advisory GHSA-4ghp-wxpw-rhpg published
2026-07-15: patched: Version 0.40.6 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.