Read the docs
TI-2026-01349 Aliases CVE-2026-1665

Command Injection in nvm via NVM_AUTH_HEADER in wget code path

Priority LOW 28CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00779 56th percentileScored 2026-11-07
Fix Fixed nvm (nvm-sh): 0.40.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nvm-shnvm0.40.0 – 0.40.30.40.4Patch availableCNA
  • nvm Vendornvm-sh Affected 0.40.0 – 0.40.3 Fixed in 0.40.4 Patch available CNA

Remediation

  • Fix · CNA nvm (nvm-sh) Fixed in 0.40.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1665

References

Patch 1

Other 3

  • TI-2026-13337 nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory CVSS 4.0LOW 2.1
  • TI-2026-82282 Command injection in nvm lets version strings run arbitrary commands CVSS 4.0HIGH 7.1
  • TI-2026-85227 nvm prints contents of arbitrary files through a symlinked .nvmrc CVSS 4.0MEDIUM 6.7
  • TI-2026-85226 nvm --save follows symlinked .nvmrc and overwrites files CVSS 4.0MEDIUM 6.7
  • TI-2026-63368 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias CVSS 4.0MEDIUM 6.7
  • TI-2026-85228 nvm passes .nvmrc contents to grep, leaking local files CVSS 4.0MEDIUM 4.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences