CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings
Attackers controlling a non-default Node.js mirror can execute arbitrary commands via unsanitized version strings in nvm.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-10796?
CVE-2026-10796 is a high-severity command injection vulnerability in nvm-sh nvm, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.
Weakness: CWE-78
Which versions are affected by CVE-2026-10796?
It affects 1 product.
Products include Openjsf Node Version Manager.
How do I fix CVE-2026-10796?
No fix has been published for CVE-2026-10796 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-10796 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10796 exists.
Sources
Also known as GHSA-3c52-35h2-gfmm.