CVE-2026-15921

Name of the Vulnerable Software and Affected Versions Node Version Manager (nvm) versions 0.32.1 through 0.40.5

Description An issue exists where nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts, parse the node.js mirror's index.tab and use the LTS codename field as an alias filename without validation. A compromised mirror or a man-in-the-middle attack can return an LTS codename containing path-traversal sequences, such as ../../../.bashrc. This allows the software to write version strings to paths outside the $NVM DIR/alias directory. In default configurations where $NVM DIR is ~/.nvm, this can result in the creation or overwriting of files in the user's home directory, including shell startup files, potentially leading to code execution in subsequent shell sessions. Exploitation requires the use of a hostile mirror via a compromised CDN, network man-in-the-middle, or a malicious configuration of the NVM NODEJS ORG MIRROR or NVM IOJS ORG MIRROR variables.

Recommendations Update to version 0.40.6.