The `nvm ls` function uses a sed program to filter installed versions by embedding the requested version pattern in a `#...#` address. Because backslashes are not escaped, a version string containing `#` or `#` can prematurely close the address, causing the remaining string to be interpreted as sed commands. On systems with GNU sed, the `e` command can execute shell commands as the user, while BSD sed allows reading and writing files via the `r` and `w` commands. This issue is triggered when an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, `nvm exec`, or to `nvm-exec` via the `NODE VERSION` variable. Additionally, users employing the `cdnvm` bash hook or `load-nvmrc` zsh hook are susceptible to command execution simply by entering a directory containing a malicious `.nvmrc` file, as these hooks pass the file content directly to `nvm ls` and `nvm version`.