CVE-2026-121751

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.39.6 through 0.40.8

Description An issue exists where nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVM DIR/alias/lts/ without validation. The nvm normalize lts() function later evaluates any suffix of an lts/-N value inside shell arithmetic $((N+1)). In bash and zsh, this arithmetic evaluation expands command substitutions in array subscripts, allowing a stored value like lts/-10*path[$(cmd)1] to execute cmd as the user. This occurs when the alias is resolved by local commands such as nvm ls, nvm alias, nvm use --lts, and nvm which lts/, or in every new shell if the default alias is set to lts/*. This can also be triggered via a project .nvmrc file. Exploitation requires the use of a hostile mirror, which could be achieved through a compromised mirror or CDN, a network man-in-the-middle attack on an http:// mirror, or a maliciously configured NVM NODEJS ORG MIRROR variable.

Recommendations Update to version 0.41.0.