CVE-2026-118905

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.31.2 through 0.40.5

Description The nvm ls function uses a sed program to filter installed versions by embedding the requested version pattern in a #...# address. Because backslashes are not escaped, a version string containing # or # can prematurely close the address, causing the remaining string to be interpreted as sed commands. On systems with GNU sed, the e command can execute shell commands as the user, while BSD sed allows reading and writing files via the r and w commands. This issue is triggered when an attacker-influenced version string is passed to nvm use, nvm which, nvm ls, nvm version, nvm run, nvm exec, or to nvm-exec via the NODE VERSION variable. Additionally, users employing the cdnvm bash hook or load-nvmrc zsh hook are susceptible to command execution simply by entering a directory containing a malicious .nvmrc file, as these hooks pass the file content directly to nvm ls and nvm version.

Recommendations Update Node Version Manager (nvm) to version 0.40.6.