CVE-2026-121751

Received Received - Intake

Remote Code Execution in Node Version Manager

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: harborist

Description

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-121751

EUVD

EUVD-2026-117126

Affected Vendors & Products

Vendor	Product	Version / Range
nvm-sh	nvm	0.39.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability affects Node Version Manager (nvm) versions 0.39.6 through 0.40.8. It allows remote code execution when using a malicious mirror. The issue occurs because nvm stores version data from an untrusted source without validation and later evaluates it in a shell arithmetic context, enabling command injection through specially crafted version strings.

Detection Guidance

Check if you are using nvm versions 0.39.6 through 0.40.8. Review any custom mirrors or NVM_NODEJS_ORG_MIRROR settings for suspicious configurations. Inspect $NVM_DIR/alias/lts/ for malformed entries like lts/-10*path[$(cmd)1].

Impact Analysis

If you use a compromised or malicious Node.js mirror (via MITM attack or malicious configuration), an attacker could execute arbitrary commands on your system when you run commands like nvm ls, nvm alias, or nvm use --lts. This could lead to data theft, system compromise, or further network infiltration.

Mitigation Strategies

Upgrade nvm to version 0.41.0 or later. Avoid using untrusted mirrors or HTTP sources. Remove suspicious entries in $NVM_DIR/alias/lts/. Set NVM_NODEJS_ORG_MIRROR to a trusted HTTPS mirror.

Hi! I’m here to help you understand CVE-2026-121751. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...