Node Version Manager CVE-2026-15921
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H for required MITM or mirror compromise precondition; I:H because attacker-controlled content written to shell startup files yields deferred arbitrary code execution.
Primary rating from Vendor (harborist).
CVSS VectorVendor: harborist
Lifecycle Timeline
2DescriptionCVE.org
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, nvm ls-remote (and other commands that refresh remote LTS aliases, such as nvm install --lts) parse the node.js mirror's index.tab and use each release's LTS codename field as an alias filename without validating it. A malicious, compromised, or man-in-the-middled mirror can return an LTS codename containing path-traversal sequences such as ../../../.bashrc, causing nvm to write the associated version string to a path outside $NVM_DIR/alias. With the default layout ($NVM_DIR is ~/.nvm), this can create or overwrite files in the user's home directory, including shell startup files, which can lead to code execution in a later shell session. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle, or a maliciously configured NVM_NODEJS_ORG_MIRROR/NVM_IOJS_ORG_MIRROR -- and to run an affected command. Version 0.40.6 validates remote LTS codenames as safe alias filenames and rejects .. path components when writing alias files.
AnalysisAI
Path traversal in nvm versions 0.32.1 through 0.40.5 allows a hostile Node.js mirror to overwrite arbitrary files in the victim's home directory, including shell startup files, leading to code execution on the next shell session. The vulnerability exists in nvm ls-remote, nvm install --lts, and any other nvm command that refreshes remote LTS aliases by fetching and parsing a mirror's index.tab - the LTS codename field is used as an alias filename without sanitization, permitting sequences like ../../../.bashrc to escape $NVM_DIR/alias. No public exploit identified at time of analysis, but a working proof-of-concept is embedded in the upstream test suite added in the fix commit.
Technical ContextAI
nvm is a POSIX shell function (not a compiled binary) that manages multiple Node.js installations by writing small alias files under $NVM_DIR/alias/lts/. When refreshing LTS metadata it fetches the mirror's index.tab, a tab-delimited file where column 10 is the LTS codename (e.g., 'Iron'). CWE-22 (Path Traversal) applies because nvm used this field directly as a filename component via nvm_make_alias without stripping .. path segments. A mirror-supplied codename of ../../../.bashrc causes the shell's printf > '$NVM_DIR/alias/../../../.bashrc' write to resolve to the user's home directory. The content written is the version string from the same mirror row - also attacker-controlled - enabling injection of arbitrary shell code. Affected CPE: cpe:2.3:a:nvm-sh:nvm:*:*:*:*:*:*:*:* versions 0.32.1-0.40.5. The fix (commit 9275c5b) adds two controls: an awk regex ^[a-z0-9][a-z0-9._-]*$ rejecting non-conforming codenames during index.tab parsing, and a case block in nvm_make_alias that rejects any alias containing a /../ component.
RemediationAI
Upgrade to nvm version 0.40.6, which validates LTS codenames against a strict allowlist regex and rejects any alias containing .. path components. The patch commit is available at https://github.com/nvm-sh/nvm/commit/9275c5badda1d9d0cdad6f34598a111033eadb42 and the security advisory at https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg. As a compensating control for users who cannot upgrade immediately, explicitly set NVM_NODEJS_ORG_MIRROR to the canonical https://nodejs.org/dist and NVM_IOJS_ORG_MIRROR to the canonical io.js mirror in shell startup files to prevent redirection to a hostile mirror - note this does not protect against MITM attacks on the network path. Pinning DNS resolution for nodejs.org to a known-good IP or enforcing HTTPS certificate pinning in corporate environments provides an additional layer of defense against MITM scenarios, though these controls add operational complexity. Inspecting $NVM_DIR/alias/lts/ for filenames containing dots or slashes can help detect prior exploitation.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today