---
id: "CVE-2026-121751"
kind: "vulnerability"
aliases: ["CVE-2026-121751"]
title: "nvm: hostile mirror's LTS index runs shell commands on version resolve"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bash", "node", "nvm", "other", "zsh"]
not_affected_if: ["dash", "default-mirror-only", "trusted-https-mirror", "version-outside-0.39.6-0.40.8"]
published_at: "2026-11-04T22:17:55+00:00"
first_seen_at: "2026-11-04T23:08:48+00:00"
updated_at: "2026-11-04T23:10:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121751", "first_seen_at": "2026-11-04T23:08:48+00:00"}]
exploit_sources: []
---

# nvm: hostile mirror's LTS index runs shell commands on version resolve

nvm stores unvalidated version strings from a remote mirror's index.tab and later evaluates them in shell arithmetic, so crafted values run commands. An attacker who controls or intercepts the mirror gets commands run as the user under bash or zsh.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed nvm version in the shell that uses it; affected versions are `0.39.6` through `0.40.8`.
- List files in `$NVM_DIR/alias/lts/` and look for unexpected lts alias values containing `$(` or other shell syntax.
- Check whether `NVM_NODEJS_ORG_MIRROR` is set to a non-default or untrusted mirror, and whether `http://` mirrors are in use.

## Fix

- nvm: move to `0.41.0`

## Timeline

- 2026-11-04T23:08:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121751

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nvm-sh/nvm/security/advisories/GHSA-7prg-rw9c-82h7
- [fix] Patch: github.com https://github.com/nvm-sh/nvm/commit/aa0572b7c48b2652a9f86276bbbf3840939981af

## From the sources

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_