Nvm
Monthly
OS command injection in Node Version Manager (nvm) 0.31.2 through 0.40.5 lets an attacker-influenced version string break out of the sed address used by nvm_ls and be parsed as sed commands, running arbitrary shell commands as the invoking user under GNU sed (the 'e' command) or reading/writing files under BSD sed (the 'w' and 'r' commands). Reachability is conditional and local: the crafted string must be passed to nvm use, nvm which, nvm ls, nvm version, nvm run, nvm exec, or nvm-exec via NODE_VERSION, at least one Node version must already be installed, and the README-documented bash cdnvm or zsh load-nvmrc auto-switch hooks turn a malicious .nvmrc into drive-by execution when the user changes into that directory (a bare nvm use is unaffected because nvm's own .nvmrc parser strips comments, as are scripts that run nvm use "$(cat .nvmrc)" - those remain exposed). No public exploit identified at time of analysis; the vendor fix landed in 0.40.6 and this is queued for remediation this week rather than treated as an emergency.
Command injection in nvm (Node Version Manager) versions through 0.40.4 allows attackers controlling the configured Node.js/io.js mirror to execute arbitrary shell commands as the user running nvm. Mirror-supplied version strings flow unsanitized into an `eval`'d curl/wget invocation in `nvm_download()` and into an awk program in `nvm_get_checksum()`, enabling injection via constructs like `$(id)`. No public exploit is identified at time of analysis, but the GitHub Security Advisory (GHSA-3c52-35h2-gfmm) and committed regression tests demonstrate the bug class, and CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) reflects that the default TLS-protected nodejs.org mirror is unaffected.
Information disclosure in nvm versions before 0.40.8 allows a local attacker who controls a repository to read arbitrary files readable by the invoking user when the developer runs `nvm use`, `nvm install`, or `nvm which` with a crafted `.nvmrc`, or when the user manually runs `nvm alias` with a traversing name. The path traversal in alias resolution causes nvm to print non-comment lines from the opened file in an error message; the automated `.nvmrc` route exposes only the first non-comment/non-empty line, while the manual `nvm alias` route can expose all such lines. No public exploit code or active exploitation has been identified at time of analysis, and the vendor addressed the issue in nvm 0.40.8.
Path traversal in nvm versions 0.32.1 through 0.40.5 allows a hostile Node.js mirror to overwrite arbitrary files in the victim's home directory, including shell startup files, leading to code execution on the next shell session. The vulnerability exists in `nvm ls-remote`, `nvm install --lts`, and any other nvm command that refreshes remote LTS aliases by fetching and parsing a mirror's `index.tab` - the LTS codename field is used as an alias filename without sanitization, permitting sequences like `../../../.bashrc` to escape `$NVM_DIR/alias`. No public exploit identified at time of analysis, but a working proof-of-concept is embedded in the upstream test suite added in the fix commit.
OS command injection in Node Version Manager (nvm) 0.31.2 through 0.40.5 lets an attacker-influenced version string break out of the sed address used by nvm_ls and be parsed as sed commands, running arbitrary shell commands as the invoking user under GNU sed (the 'e' command) or reading/writing files under BSD sed (the 'w' and 'r' commands). Reachability is conditional and local: the crafted string must be passed to nvm use, nvm which, nvm ls, nvm version, nvm run, nvm exec, or nvm-exec via NODE_VERSION, at least one Node version must already be installed, and the README-documented bash cdnvm or zsh load-nvmrc auto-switch hooks turn a malicious .nvmrc into drive-by execution when the user changes into that directory (a bare nvm use is unaffected because nvm's own .nvmrc parser strips comments, as are scripts that run nvm use "$(cat .nvmrc)" - those remain exposed). No public exploit identified at time of analysis; the vendor fix landed in 0.40.6 and this is queued for remediation this week rather than treated as an emergency.
Command injection in nvm (Node Version Manager) versions through 0.40.4 allows attackers controlling the configured Node.js/io.js mirror to execute arbitrary shell commands as the user running nvm. Mirror-supplied version strings flow unsanitized into an `eval`'d curl/wget invocation in `nvm_download()` and into an awk program in `nvm_get_checksum()`, enabling injection via constructs like `$(id)`. No public exploit is identified at time of analysis, but the GitHub Security Advisory (GHSA-3c52-35h2-gfmm) and committed regression tests demonstrate the bug class, and CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) reflects that the default TLS-protected nodejs.org mirror is unaffected.
Information disclosure in nvm versions before 0.40.8 allows a local attacker who controls a repository to read arbitrary files readable by the invoking user when the developer runs `nvm use`, `nvm install`, or `nvm which` with a crafted `.nvmrc`, or when the user manually runs `nvm alias` with a traversing name. The path traversal in alias resolution causes nvm to print non-comment lines from the opened file in an error message; the automated `.nvmrc` route exposes only the first non-comment/non-empty line, while the manual `nvm alias` route can expose all such lines. No public exploit code or active exploitation has been identified at time of analysis, and the vendor addressed the issue in nvm 0.40.8.
Path traversal in nvm versions 0.32.1 through 0.40.5 allows a hostile Node.js mirror to overwrite arbitrary files in the victim's home directory, including shell startup files, leading to code execution on the next shell session. The vulnerability exists in `nvm ls-remote`, `nvm install --lts`, and any other nvm command that refreshes remote LTS aliases by fetching and parsing a mirror's `index.tab` - the LTS codename field is used as an alias filename without sanitization, permitting sequences like `../../../.bashrc` to escape `$NVM_DIR/alias`. No public exploit identified at time of analysis, but a working proof-of-concept is embedded in the upstream test suite added in the fix commit.