CVE-2026-1665 Command Injection in nvm via NVM_AUTH_HEADER in wget code path
Attackers can execute arbitrary shell commands via unsanitized environment variables in nvm's wget download path, affecting developers using affected versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-1665?
CVE-2026-1665 is a medium-severity command injection vulnerability in nvm-sh nvm, published on 29 Jan 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.
Which versions are affected by CVE-2026-1665?
How do I fix CVE-2026-1665?
No fix has been published for CVE-2026-1665 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-1665 being exploited?
There is no known exploitation of CVE-2026-1665 in the wild and no public exploit code.