Node Version Manager CVE-2026-118905

Requires nvm 0.31.2 through 0.40.5 with at least one node version already installed, and an attacker-influenced version string containing '#' (or '\#') reaching nvm_ls via nvm use, nvm which, nvm ls, nvm version, nvm run, nvm exec, or nvm-exec through NODE_VERSION. For the drive-by .nvmrc path the victim must have the non-default bash cdnvm or zsh load-nvmrc auto-switch hook (documented in the README but not installed by default) and change into a directory under a malicious .nvmrc, or run a script that does nvm use "$(cat .nvmrc)". Key limiting factors: a bare nvm use is NOT affected because nvm's own .nvmrc parser strips comments; exploitation needs local access plus victim interaction; and full arbitrary command execution applies only under GNU sed (the e command), whereas BSD sed limits impact to file write/read via w/r.

This is a genuine but conditional OS command injection (CWE-78/CWE-94) rather than a drop-everything remote flaw. The CVSS 4.0 vector (7.1, AV:L/AC:L/AT:P/PR:N/UI:A) correctly signals a local vector that requires both user interaction and a specific attack precondition, which matches the described mechanism: the attacker only plants a malicious .nvmrc, but code runs only when a victim with the bash cdnvm or zsh load-nvmrc auto-switch hook installed cd's into the directory (or runs a script like nvm use "$(cat .nvmrc)"), and at least one node version is installed. No KEV listing is present and no EPSS score was supplied, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_week', consistent with a serious issue that is not an emergency. Exploitation status is 'no public exploit identified at time of analysis' - the GHSA advisory ships a regression test that demonstrates the sed error, but no weaponized exploit is flagged in the input. The most important nuance: real impact depends on the sed implementation - with GNU sed the e command yields arbitrary shell command execution as the user (full compromise), while with BSD sed only the w/r file write/read commands are reachable, limiting impact to file read/write. The headline risk is to developer workstations using auto-switch hooks, not to default nvm installs (bare nvm use is unaffected because nvm's own .nvmrc parser strips comments).

An attacker publishes a repository containing a malicious .nvmrc whose version string embeds a # to close the sed address early followed by a sed e command. A developer who has the documented bash cdnvm or zsh load-nvmrc auto-switch hook installed clones the repo and changes into the directory; the hook reads .nvmrc verbatim and passes it to nvm ls/nvm version, and with GNU sed the injected e command executes the attacker's shell payload as that user. No public weaponized exploit is flagged, though the vendor advisory includes a test case that reproduces the parsing flaw.