TI-2026-13337 CVE-2026-15921
nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory
Priority MEDIUM 44
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
nvm-sh
Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
nvm-sh records in CISA KEVNo nvm-sh vulnerabilities are listed in CISA KEV.
Records
11 records
Priority LOW 32
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
Priority LOW 29
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
Priority LOW 29
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
TI-2026-63368 CVE-2026-94185
nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
Priority LOW 29
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias.
Priority LOW 28
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below.
Priority LOW 20
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
Priority LOW 11
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
Priority LOW 10
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
Priority LOW 10
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.
Priority LOW 9
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions.