CyberSecBulletin

Nvm-sh vulnerabilities

We track 2 vulnerabilities in Nvm-sh products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.

2vulnerabilities
0critical
2high
0exploited
7.3average CVSS score

Latest Nvm-sh vulnerabilities

  • 7.0 High severity

    nvm: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-118905Nvm-sh

    Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, es

  • 7.5 High severity

    nvm: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-10796Nvm-shEPSS 5%

    nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, wit