CVE-2026-121751

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121751", "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "state": "PUBLISHED", "assignerShortName": "harborist", "dateReserved": "2026-11-03T23:39:04.553Z", "datePublished": "2026-11-04T21:26:57.967Z", "dateUpdated": "2026-11-09T20:44:45.880Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "shortName": "harborist", "dateUpdated": "2026-11-04T21:26:57.967Z"}, "title": "nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "affected": [{"vendor": "nvm-sh", "product": "nvm", "repo": "https://github.com/nvm-sh/nvm", "versions": [{"status": "affected", "version": "0.39.6", "lessThan": "0.41.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.</p>"}]}], "references": [{"url": "https://github.com/nvm-sh/nvm/security/advisories/GHSA-7prg-rw9c-82h7", "name": "GHSA-7prg-rw9c-82h7", "tags": ["vendor-advisory"]}, {"url": "https://github.com/nvm-sh/nvm/commit/aa0572b7c48b2652a9f86276bbbf3840939981af", "name": "Fix commit aa0572b7", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "workarounds": [{"lang": "en", "value": "Until upgrading, only run `nvm ls-remote` and LTS-refreshing commands against trusted mirrors over TLS, ensure `NVM_NODEJS_ORG_MIRROR` points only at a trusted endpoint, and do not run nvm in untrusted project directories.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Until upgrading, only run `nvm ls-remote` and LTS-refreshing commands against trusted mirrors over TLS, ensure `NVM_NODEJS_ORG_MIRROR` points only at a trusted endpoint, and do not run nvm in untrusted project directories.</p>"}]}], "solutions": [{"lang": "en", "value": "Upgrade to nvm 0.41.0 or later, which only lets an all-digit `lts/-N` offset reach shell arithmetic and drops mirror rows with invalid version strings. (Only needed if using a non-default mirror whose metadata contents you do not trust, or running nvm in untrusted project directories.)", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Upgrade to nvm 0.41.0 or later, which only lets an all-digit `lts/-N` offset reach shell arithmetic and drops mirror rows with invalid version strings. (Only needed if using a non-default mirror whose metadata contents you do not trust, or running nvm in untrusted project directories.)</p>"}]}], "credits": [{"lang": "en", "value": "Anthropic's OSS Scanner, as vulnerabilities ANT-2026-0GXXE91V and ANT-2026-31ZIEY85", "type": "finder"}, {"lang": "en", "value": "Adel Assakaf (https://github.com/assakafpix)", "type": "finder"}, {"lang": "en", "value": "Jordan Harband (https://github.com/ljharb)", "type": "remediation developer"}], "source": {"advisory": "GHSA-7prg-rw9c-82h7", "discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T20:44:30.272734Z", "id": "CVE-2026-121751", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:44:45.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121751", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T20:44:30.272734Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:44:41.336Z"}}], "cna": {"title": "nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases", "source": {"advisory": "GHSA-7prg-rw9c-82h7", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Anthropic's OSS Scanner, as vulnerabilities ANT-2026-0GXXE91V and ANT-2026-31ZIEY85"}, {"lang": "en", "type": "finder", "value": "Adel Assakaf (https://github.com/assakafpix)"}, {"lang": "en", "type": "remediation developer", "value": "Jordan Harband (https://github.com/ljharb)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/nvm-sh/nvm", "vendor": "nvm-sh", "product": "nvm", "versions": [{"status": "affected", "version": "0.39.6", "lessThan": "0.41.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to nvm 0.41.0 or later, which only lets an all-digit `lts/-N` offset reach shell arithmetic and drops mirror rows with invalid version strings. (Only needed if using a non-default mirror whose metadata contents you do not trust, or running nvm in untrusted project directories.)", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to nvm 0.41.0 or later, which only lets an all-digit `lts/-N` offset reach shell arithmetic and drops mirror rows with invalid version strings. (Only needed if using a non-default mirror whose metadata contents you do not trust, or running nvm in untrusted project directories.)</p>", "base64": false}]}], "references": [{"url": "https://github.com/nvm-sh/nvm/security/advisories/GHSA-7prg-rw9c-82h7", "name": "GHSA-7prg-rw9c-82h7", "tags": ["vendor-advisory"]}, {"url": "https://github.com/nvm-sh/nvm/commit/aa0572b7c48b2652a9f86276bbbf3840939981af", "name": "Fix commit aa0572b7", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Until upgrading, only run `nvm ls-remote` and LTS-refreshing commands against trusted mirrors over TLS, ensure `NVM_NODEJS_ORG_MIRROR` points only at a trusted endpoint, and do not run nvm in untrusted project directories.", "supportingMedia": [{"type": "text/html", "value": "<p>Until upgrading, only run `nvm ls-remote` and LTS-refreshing commands against trusted mirrors over TLS, ensure `NVM_NODEJS_ORG_MIRROR` points only at a trusted endpoint, and do not run nvm in untrusted project directories.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.", "supportingMedia": [{"type": "text/html", "value": "<p>Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "shortName": "harborist", "dateUpdated": "2026-11-04T21:26:57.967Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121751", "state": "PUBLISHED", "dateUpdated": "2026-11-09T20:44:45.880Z", "dateReserved": "2026-11-03T23:39:04.553Z", "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "datePublished": "2026-11-04T21:26:57.967Z", "assignerShortName": "harborist"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "nvm", "repo": "https://github.com/nvm-sh/nvm", "vendor": "nvm-sh", "versions": [{"lessThan": "0.41.0", "status": "affected", "version": "0.39.6", "versionType": "semver"}]}], "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string."}], "id": "CVE-2026-121751", "lastModified": "2026-11-10T21:46:26.307", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121751", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T20:44:30.272734Z", "version": "2.0.3"}}]}, "published": "2026-11-04T22:17:55.060", "references": [{"source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "url": "https://github.com/nvm-sh/nvm/commit/aa0572b7c48b2652a9f86276bbbf3840939981af"}, {"source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "url": "https://github.com/nvm-sh/nvm/security/advisories/GHSA-7prg-rw9c-82h7"}], "sourceIdentifier": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-78"}], "source": "7ffcee3d-2c14-4c3e-b844-86c6a321a158", "type": "Secondary"}]}

{"bugzilla": {"description": "nvm: nvm: Arbitrary command execution via unvalidated mirror data in shell arithmetic", "id": "2567623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567623"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, `nvm ls-remote` (and other commands that refresh remote LTS aliases) store the version column of the mirror's `index.tab` in `$NVM_DIR/alias/lts/` without validating it, and `nvm_normalize_lts` later evaluates any suffix of an `lts/-N` value inside shell arithmetic `$((N+1))`. Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as `lts/-10*path[$(cmd)1]` runs `cmd` as the user when the alias is later resolved by purely local commands (`nvm ls`, `nvm alias`, `nvm use --lts`, `nvm which lts/`), and in every new shell when the `default` alias is `lts/*`. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an `http://` mirror, or a maliciously configured `NVM_NODEJS_ORG_MIRROR` -- and to run an affected command. The same sink is also reachable from a project `.nvmrc`, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit `lts/-N` offset to arithmetic and drops `index.tab` rows whose version is not a valid version string.", "A flaw was found in Node Version Manager (nvm). Remote version data retrieved from a mirror is stored without sufficient validation and later evaluated during shell arithmetic operations. An attacker controlling a malicious or compromised mirror can provide crafted version strings that trigger arbitrary command execution with the privileges of the local user when affected nvm commands or new shell sessions are run."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-121751", "public_date": "2026-11-04T21:26:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121751\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121751\nhttps://github.com/nvm-sh/nvm/commit/aa0572b7c48b2652a9f86276bbbf3840939981af\nhttps://github.com/nvm-sh/nvm/security/advisories/GHSA-7prg-rw9c-82h7"], "statement": "This vulnerability is rated as having an Important impact because successful exploitation permits arbitrary command execution in the context of the executing user. While shell arithmetic evaluation can trigger execution during normal command invocations or new shell startups, exploitation depends on significant prerequisites such as network traffic interception or interacting with a hostile mirror. Red Hat Enterprise Linux does not distribute the Node Version Manager utility, relying instead on official Node.js application streams.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.39.6,0.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nvm", "source": "cna", "vendor": "nvm-sh"}, "product": "nvm", "vendor": "nvm-sh"}], "created": "2026-11-04T22:45:14.986514+00:00", "updated": "2026-11-04T23:00:21.131335+00:00", "vendors": ["nvm-sh", "nvm-sh$PRODUCT$nvm"]}