Live › vulnerability › CVE-2026-118905
Versions 0.31.2 through 0.40.5 of nvm build a sed program from the requested version string without escaping backslashes, so a '#' in that string lets an attacker inject sed commands. With GNU sed this runs a shell command as the user; with BSD sed it can read and write files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Developers who use nvm on a machine with at least one Node version installed, especially those who use the bash cdnvm or zsh load-nvmrc auto-switch hooks, or scripts that pass .nvmrc contents to nvm. An attacker needs a malicious .nvmrc or version string to reach the flawed code. Plain nvm use with no hook and no untrusted input is not affected per the description.
No product ranges from the sources yet.
nvm --version and check whether it falls in 0.31.2 through 0.40.5.cdnvm or zsh load-nvmrc hook is installed in shell startup files, since those read .nvmrc files automatically.nvm use "$(cat .nvmrc)" on untrusted repositories.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . (and, since 0.40.4, #) but not backslash. A version string containing # (or \#) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the e command runs a shell command as the user; with BSD sed, the w and r commands write and read files. This is reachable whenever an attacker-influenced version string is passed to nvm use, nvm which, nvm ls, nvm version, nvm run, or nvm exec, or to nvm-exec via NODE_VERSION, and at least one version is installed. nvm's own .nvmrc parser strips comments, so a bare nvm use is not affected; however, the bash cdnvm and zsh load-nvmrc auto-switch hooks documented in the README read .nvmrc as-is and pass it to nvm ls and nvm version, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious .nvmrc; scripts that run nvm use "$(cat .nvmrc)" are affected the same way. Version 0.40.6 passes any version pattern containing # or a newline through the .nvmrc content parser first, so no # reaches the sed program.
This page as .md · .json · in your agent: get_signal("CVE-2026-118905")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.