NV
Vendor
nvm-sh
5
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118905 New | NV nvm nvm-sh | 7.0 | Oct 29 | nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed |
| CVE-2026-94185 | NV nvm nvm-sh | 5.5 | Sep 21 | nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias |
| CVE-2026-15921 | NV nvm nvm-sh | 3.1 | Jul 15 | nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory |
| CVE-2026-10796 | NV nvm nvm-sh | 7.5 | Jun 4 | nvm executes commands from a malicious Node.js mirror's version strings |
| CVE-2026-1665 | NV nvm nvm-sh | 5.4 | Jan 29 | Command Injection in nvm via NVM_AUTH_HEADER in wget code path |