{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anode_version_managernode_version_manager/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:node_version_manager:node_version_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7,"id":"CVE-2026-118905"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Node Version Manager (0.31.2 \u003c= 0.40.5)"],"_cs_severities":["high"],"_cs_tags":["command-injection","vulnerability","linux","macos"],"_cs_type":"advisory","_cs_vendors":["Node Version Manager"],"content_html":"\u003cp\u003eCVE-2026-118905 describes a command injection vulnerability in nvm (Node Version Manager) versions 0.31.2 through 0.40.5. The \u003ccode\u003envm_ls\u003c/code\u003e function uses an improperly sanitized sed program to filter installed versions. By providing a version string containing specific characters such as \u003ccode\u003e#\u003c/code\u003e, an attacker can escape the intended sed address context and inject arbitrary commands.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is triggered when an attacker-controlled version string is passed to commands like \u003ccode\u003envm use\u003c/code\u003e, \u003ccode\u003envm which\u003c/code\u003e, \u003ccode\u003envm ls\u003c/code\u003e, \u003ccode\u003envm version\u003c/code\u003e, \u003ccode\u003envm run\u003c/code\u003e, or \u003ccode\u003envm exec\u003c/code\u003e, or via the \u003ccode\u003eNODE_VERSION\u003c/code\u003e environment variable. Users employing auto-switching hooks (e.g., \u003ccode\u003ecdnvm\u003c/code\u003e or \u003ccode\u003eload-nvmrc\u003c/code\u003e) or scripts that pass raw \u003ccode\u003e.nvmrc\u003c/code\u003e contents to nvm commands are at particular risk, as changing to a directory containing a malicious \u003ccode\u003e.nvmrc\u003c/code\u003e file can trigger execution. The issue is resolved in version 0.40.6.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows arbitrary command execution as the user running the nvm command or the shell hook. Using GNU sed, this can lead to direct shell command execution; using BSD sed, this can lead to unauthorized file read and write operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch nvm to version 0.40.6 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit environments for scripts that pass file contents or environment variables directly to \u003ccode\u003envm\u003c/code\u003e commands without validation.\u003c/li\u003e\n\u003cli\u003eAudit shell initialization files (\u003ccode\u003e.bashrc\u003c/code\u003e, \u003ccode\u003e.zshrc\u003c/code\u003e) for \u003ccode\u003ecdnvm\u003c/code\u003e or \u003ccode\u003eload-nvmrc\u003c/code\u003e hooks that automatically process \u003ccode\u003e.nvmrc\u003c/code\u003e files without sanitization.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T07:09:42Z","date_published":"2026-10-29T07:09:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nvm-command-injection/","summary":"Node Version Manager (nvm) versions 0.31.2 through 0.40.5 are vulnerable to command injection via malicious version strings due to improper sanitization in the nvm_ls function when invoked with tools like nvm use or automated shell hooks.","title":"Node Version Manager: Command injection in nvm_ls (CVE-2026-118905)","url":"https://feed.craftedsignal.io/briefs/2026-10-nvm-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:node_version_manager:node_version_manager:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}