CVE-2026-15921

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and other commands that refresh remote LTS aliases, such as `nvm install --lts`) parse the node.js mirror's `index.tab` and use each release's LTS codename field as an alias filename without validating it. A malicious, compromised, or man-in-the-middled mirror can return an LTS codename containing path-traversal sequences such as `../../../.bashrc`, causing nvm to write the associated version string to a path outside `$NVM_DIR/alias`. With the default layout (`$NVM_DIR` is `~/.nvm`), this can create or overwrite files in the user's home directory, including shell startup files, which can lead to code execution in a later shell session. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle, or a maliciously configured `NVM_NODEJS_ORG_MIRROR`/`NVM_IOJS_ORG_MIRROR` -- and to run an affected command. Version 0.40.6 validates remote LTS codenames as safe alias filenames and rejects `..` path components when writing alias files.

• CWE-22
• CWE-73

• https://github.com/nvm-sh/nvm/commit/9275c5badda1d9d0cdad6f34598a111033eadb42
• https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg
• https://github.com/nvm-sh/nvm/security/advisories/GHSA-4ghp-wxpw-rhpg

Published

Jul 15, 2026

Last Modified

Jul 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15913In versions prior to 7.10.2 a path traversal vulnerability i…7.7
• CVE-2026-15916Missing Authorization vulnerability in Drupal Drupal core al…4.2
• CVE-2026-15917Improper Neutralization of Input During Web Page Generation …4.7
• CVE-2026-15918VikAppointments Service Booking Calendar wordpress plugin is…7.5
• CVE-2026-1592Foxit PDF Editor Cloud (pdfonline) contains a stored cross-s…5.4
• CVE-2026-15920An issue was discovered in Django 5.2 before 5.2.17 and 6.0 …6.1
• CVE-2026-15923The Zephyr SDIO subsystem function sdio_io_rw_extended_helpe…4.6
• CVE-2026-15924Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_…5.9
• CVE-2026-15925Improper TLS hostname verification in Snowflake Connector fo…9.2
• CVE-2026-15926Rejected reason: Red Hat Product Security has determined tha…
• CVE-2026-15927A flaw was found in Red Hat Quay's repository-level mirror c…6.8
• CVE-2026-15928XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerabl…8.2