Node Version Manager: Command injection in nvm_ls (CVE-2026-118905)

CVE-2026-118905 describes a command injection vulnerability in nvm (Node Version Manager) versions 0.31.2 through 0.40.5. The nvm_ls function uses an improperly sanitized sed program to filter installed versions. By providing a version string containing specific characters such as #, an attacker can escape the intended sed address context and inject arbitrary commands.

The vulnerability is triggered when an attacker-controlled version string is passed to commands like nvm use, nvm which, nvm ls, nvm version, nvm run, or nvm exec, or via the NODE_VERSION environment variable. Users employing auto-switching hooks (e.g., cdnvm or load-nvmrc) or scripts that pass raw .nvmrc contents to nvm commands are at particular risk, as changing to a directory containing a malicious .nvmrc file can trigger execution. The issue is resolved in version 0.40.6.

Impact

Successful exploitation allows arbitrary command execution as the user running the nvm command or the shell hook. Using GNU sed, this can lead to direct shell command execution; using BSD sed, this can lead to unauthorized file read and write operations.

Recommendation

• Patch nvm to version 0.40.6 or later immediately.
• Audit environments for scripts that pass file contents or environment variables directly to nvm commands without validation.
• Audit shell initialization files (.bashrc, .zshrc) for cdnvm or load-nvmrc hooks that automatically process .nvmrc files without sanitization.