Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121751— nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Node Version Manager (nvm) 是一个符合 POSIX 标准的 Shell 函数，用于管理多个 Node.js 版本。在 0.39.6 至 0.40.8 版本中， （以及其他用于刷新远程 LTS 别名的命令）会将镜像服务器 文件中的“版本列”内容直接存储到 目录下，而未进行任何验证。随后， 函数会在 Shell 算术表达式 中对 形式的值进行求值。 在 Bash 和 Zsh 环境中，算术求值过程会展开数组下标中的命令替换（command substitution）。因此，若存储的值为类似 的恶

CVSS 3.1 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121751

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases
Source: CVE Program / CVE List V5
Vulnerability Description
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0.39.6 ~ 0.41.0 -

II. Public POCs for CVE-2026-121751

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121751

请登录查看更多情报信息。

Other References for CVE-2026-121751 (2)

Same Patch Batch · nvm-sh · 2026-11-04 · 7 CVEs total

CVE-2026-121746 5.5 MEDIUM nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any fi
CVE-2026-121747 5.5 MEDIUM nvm prints the contents of any readable file through a symlinked .nvmrc
CVE-2026-121748 3.6 LOW nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes worl
CVE-2026-121749 3.3 LOW nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options an
CVE-2026-121750 3.1 LOW nvm install --offline installs a cached tarball that previously failed checksum verificati
CVE-2026-121745 2.5 LOW nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-78