# nvm.

Every CVE that names nvm among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write](https://agentprime.io/advisories/CVE-2026-121746.md)
  `CVE-2026-121746` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal
- [nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files](https://agentprime.io/advisories/CVE-2026-121749.md)
  `CVE-2026-121749` · CVE record: nvm-sh nvm · CVSS 4.6 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection
- [nvm prints the contents of any readable file through a symlinked .nvmrc](https://agentprime.io/advisories/CVE-2026-121747.md)
  `CVE-2026-121747` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal, Information disclosure, CWE-61
- [nvm use --delete-prefix lets a project .npmrc choose which file npm rewrites or makes world-writable](https://agentprime.io/advisories/CVE-2026-121748.md)
  `CVE-2026-121748` · CVE record: nvm-sh nvm · CVSS 1.8 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal
- [nvm install --offline installs a cached tarball that previously failed checksum verification](https://agentprime.io/advisories/CVE-2026-121750.md)
  `CVE-2026-121750` · CVE record: nvm-sh nvm · CVSS 2.1 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-459, CWE-494
- [nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line](https://agentprime.io/advisories/CVE-2026-121745.md)
  `CVE-2026-121745` · CVE record: nvm-sh nvm · CVSS 2.0 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-214
- [nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases](https://agentprime.io/advisories/CVE-2026-121751.md)
  `CVE-2026-121751` · CVE record: nvm-sh nvm · CVSS 2.1 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection, CWE-20
- [nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed](https://agentprime.io/advisories/CVE-2026-118905.md)
  `CVE-2026-118905` · CVE record: nvm-sh nvm · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, Code injection
- [nvm alias resolution follows \`..\` and discloses files outside $NVM_DIR/alias](https://agentprime.io/advisories/CVE-2026-94185.md)
  `CVE-2026-94185` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, Information disclosure
- [nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory](https://agentprime.io/advisories/CVE-2026-15921.md)
  `CVE-2026-15921` · CVE record: nvm-sh nvm · CVSS 2.1 Low · Not analysed yet · Published 15 Jul 2026 · Tags: Path traversal
- [nvm executes commands from a malicious Node.js mirror's version strings](https://agentprime.io/advisories/CVE-2026-10796.md)
  `CVE-2026-10796` · CVE record: nvm-sh nvm · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2026 · Tags: Command injection
- [Command Injection in nvm via NVM_AUTH_HEADER in wget code path](https://agentprime.io/advisories/CVE-2026-1665.md)
  `CVE-2026-1665` · CVE record: nvm-sh nvm · CVSS 5.4 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: Command injection, Code injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=nvm>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/nvm/>. Everything for agents: <https://agentprime.io/llms.txt>.