IT SBIT Services
Schneeberger
DEEN
CVE tracker

nvm: Command injection via crafted version string or .nvmrc in sed program

CVE-2026-118905High 7.1

← All vulnerabilities

Summary

Node Version Manager (nvm) versions 0.31.2 through 0.40.5 let an attacker-influenced version string inject sed commands through the nvm_ls function, because a '#' character closes the sed address early. With GNU sed this executes arbitrary shell commands as the current user. The attack is triggered when a malicious .nvmrc file is read by the cdnvm or load-nvmrc auto-switch hooks, or by scripts that run nvm use "$(cat .nvmrc)", as soon as the user enters the directory.

Affected

  • nvm (nvm-sh/nvm) versions 0.31.2 up to but not including 0.40.6
  • Requires at least one installed Node.js version

Fixed in

  • Upgrade to nvm 0.40.6 or later (latest stable release recommended)

Workaround

  • Do not pass untrusted version strings to nvm commands
  • Do not use cdnvm or load-nvmrc auto-switch hooks in untrusted repositories
  • Do not feed .nvmrc contents directly into nvm commands in scripts or CI jobs

Exploitation

  • Not known to be exploited.
  • No public proof of concept known at the time of writing.
  • EPSS: 0.14 % (percentile 3).

Our recommendation

  • Identify hosts with nvm installed (command -v nvm or check ~/.nvm)
  • Upgrade nvm to 0.40.6 or later
  • Remove or disable cdnvm/load-nvmrc hooks on machines that open untrusted repositories
  • Review CI jobs that run nvm use "$(cat .nvmrc)" on external contributions

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 08:16.

Original description (NVD)

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)"` are affected the same way. Version 0.40.6 passes any version pattern containing `#` or a newline through the `.nvmrc` content parser first, so no `#` reaches the sed program.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed