{"schema":"threatline.record/2","record":{"id":"CVE-2026-118905","aliases":["GHSA-vgqf-vc3m-4wv3"],"summary":"nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed","details":"Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the `e` command runs a shell command as the user; with BSD sed, the `w` and `r` commands write and read files. This is reachable whenever an attacker-influenced version string is passed to `nvm use`, `nvm which`, `nvm ls`, `nvm version`, `nvm run`, or `nvm exec`, or to `nvm-exec` via `NODE_VERSION`, and at least one version is installed. nvm's own `.nvmrc` parser strips comments, so a bare `nvm use` is not affected; however, the bash `cdnvm` and zsh `load-nvmrc` auto-switch hooks documented in the README read `.nvmrc` as-is and pass it to `nvm ls` and `nvm version`, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious `.nvmrc`; scripts that run `nvm use \"$(cat .nvmrc)\"` are affected the same way. Version 0.40.6 passes any version pattern containing `#` or a newline through the `.nvmrc` content parser first, so no `#` reaches the sed program.","categories":["Unclassified"],"product":"nvm","vendor":"nvm-sh","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118905","source_modified_at":"2026-10-29T05:22:35.156Z","fetched_at":"2026-10-29T06:57:17.227585Z","product":"nvm","vendor":"nvm-sh","versions":[{"status":"affected","version":"0.31.2","lessThan":"0.40.6","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118905","source_modified_at":"2026-10-29T05:22:35.156Z","fetched_at":"2026-10-29T06:57:17.227585Z","package":{"name":"nvm","ecosystem":null},"version":"0.40.6","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-29T05:22:35.156Z","modified_at":"2026-10-29T05:22:35.156Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118905","fetched_at":"2026-10-29T06:57:17.227585Z","source_modified_at":"2026-10-29T05:22:35.156Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/nvm-sh/nvm/security/advisories/GHSA-vgqf-vc3m-4wv3","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/nvm-sh/nvm/commit/82315e2b189528a006da6701eac30e8c364ffd22","tags":["patch"]},{"source":"CVE List","url":"https://github.com/nvm-sh/nvm/pull/3854","tags":["patch"]},{"source":"CVE List","url":"https://github.com/nvm-sh/nvm/releases/tag/v0.40.6","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-29T05:22:35.156Z","content_hash":"1a528a943bda193c8572638b221a322052b92b22aaa6ebbd7f0c0e071ab2fedd"}}