Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118905— nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager（nvm）是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.31.2 至 0.40.5 版本中， 函数使用一个 sed 程序来过滤已安装的版本；该程序将请求的版本模式嵌入到 形式的地址中，并对 进行转义（自 0.40.4 起也对 进行转义），但未对反斜杠 进行转义。因此，若版本字符串中包含 或 ，会导致地址提前闭合，剩余部分被解析为 sed 命令：在 GNU sed 中， 命令会以当前用户身份执行 Shell 命令；在 BSD se

CVSS 7.0 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118905

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed
Source: CVE Program / CVE List V5
Vulnerability Description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use "$(cat .nvmrc)"` are affected the same way. Version 0.40.6 passes any version pattern containing `#` or a newline through the `.nvmrc` content parser first, so no `#` reaches the sed program.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0.31.2 ~ 0.40.6 -

II. Public POCs for CVE-2026-118905

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118905

请登录查看更多情报信息。

Other References for CVE-2026-118905 (4)

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-78