CVE-2026-118905 in nvm
Summary
by MITRE • 10/29/2026
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)"` are affected the same way. Version 0.40.6 passes any version pattern containing `#` or a newline through the `.nvmrc` content parser first, so no `#` reaches the sed program.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Node Version Manager (nvm) utility contains a critical command injection vulnerability affecting versions 0.31.2 through 0.40.5. This flaw stems from improper neutralization of special elements used in an interactive shell, specifically within the implementation of the `nvm_ls` function which relies on GNU sed or BSD sed for filtering installed Node.js versions. The underlying technical mechanism involves a regular expression address pattern formatted as `\#...#`. While earlier patches attempted to mitigate this by escaping periods and hash symbols, they failed to escape backslashes. This oversight allows an attacker who can influence the version string passed to nvm commands such as `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec` to inject malicious payloads. Specifically, if a version string contains a hash symbol followed by a backslash and another character that forms a valid sed command, the shell interprets this as code execution rather than literal text.
The operational impact of this vulnerability is severe due to its potential for remote code execution under specific conditions. When an attacker-influenced version string containing `\#` or `#` is processed by GNU sed, it can trigger the `e` command, which executes shell commands with the privileges of the current user. In environments using BSD sed, alternative vectors exist where the injected payload utilizes the `w` and `r` commands to write data to files or read from them, potentially leading to further compromise such as privilege escalation or malware installation. The vulnerability is particularly insidious because it can be triggered not only by direct command-line arguments but also through automated workflows. Scripts that execute `nvm use "$(cat .nvmrc)"` are directly affected if the `.nvmrc` file contains a malicious version string.
Furthermore, the risk extends to users who have configured auto-switch hooks for their shells. The bash `cdnvm` and zsh `load-nvmrc` functions documented in the official README read the `.nvmrc` file as-is without stripping comments or sanitizing content before passing it to nvm commands. Consequently, a user simply changing into a directory containing a maliciously crafted `.nvmrc` file will inadvertently trigger command execution on their local machine. This creates a significant supply chain and social engineering risk where developers might be tricked into executing arbitrary code by visiting compromised repositories or opening untrusted project directories that contain these poisoned configuration files.
The vulnerability is classified under CWE-78, which covers Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). In terms of the MITRE ATT&CK framework, this aligns with techniques involving command and script interpretation, specifically where user input is directly executed by a system shell without adequate validation. The root cause lies in the failure to properly escape backslashes within the sed address pattern, allowing the closure of the regex delimiter and subsequent parsing of injected text as executable commands.
To mitigate this vulnerability, users must upgrade Node Version Manager to version 0.40.6 or later. This release addresses the issue by ensuring that any version pattern containing a hash symbol or newline is processed through the `.nvmrc` content parser first, effectively preventing malicious characters from reaching the vulnerable sed program logic. Until an upgrade can be performed, administrators should exercise extreme caution when using nvm with untrusted inputs and avoid configuring auto-switch hooks to read `.nvmrc` files directly without sanitization. Additionally, implementing strict input validation in any custom scripts that invoke nvm commands is essential to prevent exploitation via automated pipelines or CI/CD environments where version strings might be dynamically generated from external sources.