What’s Vulnerable › Products

nvm-sh nvm vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your nvm-sh nvm version is affected

Latest nvm-sh nvm vulnerabilities

• CVE-2026-118905 — nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed (CVSS 7.0)
• CVE-2026-94185 — nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias (CVSS 5.5)
• CVE-2026-15921 — nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory (CVSS 3.1)
• CVE-2026-1665 — Command Injection in nvm via NVM_AUTH_HEADER in wget code path (CVSS 5.4)