Jordan Harband

In the `nvm ls remote index tab`, `nvm remote version`, and `nvm ls cached` functions, the requested version pattern is passed to `grep` as a bare argument without the `-e` flag. A `.nvmrc` file starting with a `-` character, such as `-Rohenpm [A-Za-z0-9]*`, can be interpreted as `grep` options. When using GNU grep, the `-R` option triggers a recursive search of the current directory. During a bare `nvm install` command, any matched string from these files is treated as a version and requested from the configured mirror. This process can lead to the disclosure of sensitive information, such as an npm token, by leaking it to the terminal and to the logs of the mirror or proxy. The disclosure is read-only and limited to characters `0-9A-Za-z. +-`.

An issue exists where `nvm ls-remote` and other commands that refresh remote LTS aliases store the version column of the mirror's `index.tab` in `$NVM DIR/alias/lts/` without validation. The `nvm normalize lts()` function later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. In bash and zsh, this arithmetic evaluation expands command substitutions in array subscripts, allowing a stored value like `lts/-10*path[$(cmd)1]` to execute `cmd` as the user. This occurs when the alias is resolved by local commands such as `nvm ls`, `nvm alias`, `nvm use --lts`, and `nvm which lts/`, or in every new shell if the `default` alias is set to `lts/*`. This can also be triggered via a project `.nvmrc` file. Exploitation requires the use of a hostile mirror, which could be achieved through a compromised mirror or CDN, a network man-in-the-middle attack on an `http://` mirror, or a maliciously configured `NVM NODEJS ORG MIRROR` variable.

The `nvm download artifact` function downloads a release archive to `$NVM DIR/.cache` and verifies the checksum after the download is complete. If a checksum mismatch occurs, the system reports an error but retains the rejected archive in the cache. A subsequent `nvm install --offline` command for the same version installs the cached file without performing a checksum verification. This allows an attacker who can modify the downloaded tarball, such as through a poisoned CDN or cache object, to achieve code execution when the victim runs the offline installation after a failed checksum attempt.

When the `NVM AUTH HEADER` variable is set, the `nvm download()` function passes credentials to curl or wget as a command-line argument. Because process arguments are visible to all local users on Linux and macOS, an unprivileged account on the same machine can read the token during the execution of commands such as `nvm ls-remote` and `nvm install`. This allows the attacker to gain unauthorized access to the private mirror. This issue specifically affects users who set `NVM AUTH HEADER` on hosts shared with other local accounts.

When using the `nvm use --save` and `nvm install --save` (or `-w`) commands, the software writes the resolved version to the `.nvmrc` file using `tee`, which follows symbolic links. If a repository contains a `.nvmrc` file that is a symbolic link to a path outside the repository, the `--save` operation can truncate any file the user has permission to write—such as shell startup files or `~/.ssh/authorized keys`—and replace its contents with the version string. This can also create the target of a dangling link. Because the symbolic link itself remains unchanged, the action does not appear in `git status`. This issue results in data loss rather than code execution, as the attacker cannot control the content being written.

Node Version Manager (nvm) fails to verify if the `.nvmrc` file is a symbolic link. An attacker can provide a repository or archive containing a `.nvmrc` file that symlinks to sensitive files, such as `../../.npmrc` or `/proc/self/environ` on Linux. When a user executes commands like `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec`, the contents of the linked file are printed in error messages or version confirmation messages. This can lead to information disclosure if the output is visible to the attacker, such as in CI logs. Additionally, users utilizing the `load-nvmrc` zsh hook or `cdnvm` bash hook may trigger this behavior simply by entering the directory.

When a project's `.npmrc` file sets the `prefix` variable, the `nvm use` command prompts the user to execute `nvm use --delete-prefix`. This action triggers `npm config delete prefix` and `npm config delete globalconfig` in the current directory without specifying a config file. Because npm loads the project `.npmrc` before determining which file to edit, an attacker can manipulate the target file. For instance, setting `userconfig=~/.bashrc` causes npm to rewrite `~/.bashrc` as an ini file, leading to corruption. Alternatively, setting `location=global` and `globalconfig=` can leave the selected file with 0666 permissions, allowing other local users on a shared machine to write to it. This can be exploited by an author of a cloned repository or a local user with write access to a shared parent directory.

The software merges configuration from the target repository, specifically from the `.auto-changelog` file and the `auto-changelog` key in `package.json`, into its options and honors security-sensitive settings from these untrusted sources. This allows for remote code execution if the tool is run over attacker-controlled content, such as in CI workflows checking out untrusted pull requests or locally on third-party repositories. Specifically, the `handlebarsSetup` option is passed to `require()`, and the `plugins` option loads modules from the repository, both of which can execute arbitrary code with the privileges of the user or CI job. Additionally, `appendGitLog` and `appendGitTag` allow git argument injection, which can be used to write arbitrary files via the `--output=` flag. The `output` option allows writing influenced content to arbitrary paths, and the `template` option can trigger outbound requests to attacker-chosen URLs.

The JavaScript fallback in `lib/sync.js` re-hashes passwords that exceed the digest's block size (64 bytes, or 128 bytes for sha384 and sha512) during every iteration. This occurs because the password is passed to HMAC as the key on each iteration, and HMAC hashes such keys in full every time. This results in a computational cost of O(iterations × password length), which can lead to the event loop being blocked when processing long passwords. This fallback is triggered by `pbkdf2Sync()` and `pbkdf2()` on Bun versions 1.0.0 through 1.1.34 and 1.2.6 and later, Deno 2.9.0 and later, and Node.js versions prior to 0.12, as well as when `lib/sync.js` is imported directly.

The `quote()` function emits a `{ comment }` token starting with `#`, which comments out the remainder of the shell line, including opening quotes of subsequent string tokens. If a subsequent string contains a line terminator (such as ` `, `r`, `U+2028`, or `U+2029`), the comment is terminated, and the remaining part of the string is executed as shell input. Additionally, the `parse()` function generates a comment token when a `#` character appears in the middle of a word. This can lead to issues when callers combine the output of `parse()` with other untrusted strings.

An issue exists where `nvm ls-remote` and other commands that refresh remote LTS aliases, such as `nvm install --lts`, parse the node.js mirror's `index.tab` and use the LTS codename field as an alias filename without validation. A compromised mirror or a man-in-the-middle attack can return an LTS codename containing path-traversal sequences, such as `../../../.bashrc`. This allows the software to write version strings to paths outside the `$NVM DIR/alias` directory. In default configurations where `$NVM DIR` is `~/.nvm`, this can result in the creation or overwriting of files in the user's home directory, including shell startup files, potentially leading to code execution in subsequent shell sessions. Exploitation requires the use of a hostile mirror via a compromised CDN, network man-in-the-middle, or a malicious configuration of the `NVM NODEJS ORG MIRROR` or `NVM IOJS ORG MIRROR` variables.

The `quote()` function fails to validate object-token inputs against the operator model used by `parse()`. Specifically, the `.op` field is escaped using a regular expression that does not match line terminators such as ` `, `r`, `U+2028`, and `U+2029`. This allows line terminators to pass unescaped into the output. Since POSIX shells treat literal newlines as command separators, any content following the newline is executed as a separate command, leading to command injection. This issue is reachable through the direct construction of `{ op: '... ...' }` from external input or via `parse(cmd, envFn)` when `envFn` returns object tokens with an attacker-influenced `.op` field.

Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the ` .unset` and ` .omit` functions. An attacker can leverage crafted paths to trigger the deletion of methods from global prototypes. The issue allows for property deletion but does not permit modification of the original behavior of those properties.