CVE-2026-1665
- Source
- https://cve.org/CVERecord?id=CVE-2026-1665
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1665.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-1665
- Published
- 2026-01-29T23:16:11.707Z
- Modified
- 2026-03-14T12:46:54.333241Z
- Severity
-
- 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvmdownload() function uses eval to execute wget commands, and the NVMAUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.
- References
Affected packages
Git / github.com/nvm-sh/nvm
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nvm-sh/nvm
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Type
- GIT
- Repo
- https://github.com/nvm-sh/nvm
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v0.*
v0.0.1
v0.0.6
v0.1.0
v0.10.0
v0.11.0
v0.11.1
v0.11.2
v0.12.0
v0.12.1
v0.12.2
v0.13.0
v0.13.1
v0.14.0
v0.15.0
v0.16.0
v0.16.1
v0.17.0
v0.17.1
v0.17.2
v0.17.3
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.22.1
v0.22.2
v0.23.0
v0.23.1
v0.23.2
v0.23.3
v0.24.0
v0.24.1
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.25.4
v0.26.0
v0.26.1
v0.27.0
v0.27.1
v0.28.0
v0.29.0
v0.3.0
v0.30.0
v0.30.1
v0.30.2
v0.31.0
v0.31.1
v0.31.2
v0.31.3
v0.31.4
v0.31.5
v0.31.6
v0.31.7
v0.32.0
v0.32.1
v0.33.0
v0.33.1
v0.33.10
v0.33.11
v0.33.2
v0.33.3
v0.33.4
v0.33.5
v0.33.6
v0.33.7
v0.33.8
v0.33.9
v0.34.0
v0.35.0
v0.35.1
v0.35.2
v0.35.3
v0.36.0
v0.37.0
v0.37.1
v0.37.2
v0.38.0
v0.39.0
v0.39.1
v0.39.2
v0.39.3
v0.39.4
v0.39.5
v0.39.6
v0.39.7
v0.4.0
v0.40.0
v0.40.1
v0.40.2
v0.40.3
v0.5.0
v0.5.1
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.9.0