# CVE-2026-15921: nvm path traversal in LTS alias creation

Source: https://junglewise.ai/threats/cve-2026-15921-nvm-path-traversal-in-lts-alias-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-15921 · Severity: low · CVSS 3.1 · Published 2026-07-15

Node Version Manager (nvm), a tool used by developers to manage different versions of Node.js, is vulnerable to a path traversal flaw. If a user connects to a malicious or compromised mirror server to download Node.js, the server can force nvm to overwrite sensitive files on the user's computer, such as shell startup scripts. This could allow an attacker to gain control over the user's system the next time they open a terminal session.

Technologies: [Nvm-Sh Nvm](https://junglewise.ai/threats/technologies/nvm). Vendors: [Nvm-Sh](https://junglewise.ai/threats/vendors/nvm-sh).

## Quick answers

**Is CVE-2026-15921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15921 being exploited in the wild.

**How severe is CVE-2026-15921?** Low severity, with a CVSS score of 3.1, published 15 July 2026.

**Which products and versions are affected?** Nvm-Sh Nvm 0.32.1 through 0.40.5.

**Is there a fix for CVE-2026-15921?** A patch was published on 2026-07-15: Version 0.40.6 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15921 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15921?** Check whether you run Nvm-Sh Nvm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in nvm's `nvm_ls_remote_index_tab` function and other commands that refresh remote LTS aliases (e.g., `nvm install --lts`). The tool parses the `index.tab` file from a Node.js mirror and uses the 10th field (LTS codename) to create alias files under `$NVM_DIR/alias/lts` without sufficient validation. An attacker controlling a mirror or performing a Man-in-the-Middle (MitM) attack can supply a codename like `../../../.bashrc`, causing nvm to write the version string to the user's shell configuration file. This leads to arbitrary command execution when the user subsequently opens a new shell session. The issue is fixed in version 0.40.6 by validating LTS codenames and rejecting `..` path components.

## Affected products

- nvm-sh nvm 0.32.1 through 0.40.5

## Timeline

- 2026-07-15: advisory: GitHub Security Advisory GHSA-4ghp-wxpw-rhpg published
- 2026-07-15: patched: Version 0.40.6 released with fix

## References

- [https://github.com/nvm-sh/nvm/commit/9275c5badda1d9d0cdad6f34598a111033eadb42](https://github.com/nvm-sh/nvm/commit/9275c5badda1d9d0cdad6f34598a111033eadb42)
- [https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg](https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg)

## Related threats

- [Node Version Manager symlinked .nvmrc file read disclosure](https://junglewise.ai/threats/cve-2026-121747-node-version-manager-nvm-is-a-posix-compliant-shell-function-for)
- [nvm OS command injection via malicious mirror version strings](https://junglewise.ai/threats/cve-2026-10796-nvm-os-command-injection-via-malicious-mirror-version-strings)