CVE-2026-10796: nvm Command Injection via Mirror Version Strings

Technical summary

The vulnerability stems from two distinct code paths in nvm that process untrusted version strings from mirror metadata. The nvm_download() function constructs curl or wget commands by directly interpolating version strings into a shell command, then executing it via eval—allowing command substitution syntax like $(id) to be interpreted by the shell. Separately, nvm_get_checksum() passes the version string directly into an awk program via string interpolation, enabling arbitrary code execution through awk's system() function. Both attack vectors require the version string to pass through the mirror's index.tab file without validation. The fixes applied to the master branch replace eval-based execution with safe argv passing, pass version data to awk as a -v variable instead of interpolating it into the program, and add grammar validation to reject malformed version strings before use.

Business impact

For organizations and developers using nvm with non-default mirrors, CI/CD pipelines configured to pull from custom mirror sources, or environments on networks where mirror traffic is unencrypted, this vulnerability allows complete command execution under the invoking user's identity. This could lead to source code theft, build artifact tampering, credential exfiltration from CI environments, lateral movement within networks, or supply chain poisoning if compromised builds are distributed. Teams using the official nodejs.org mirror over HTTPS are not at risk. However, the ease of exploitation and the breadth of potential impact in development and CI workflows elevates business risk for affected deployments.

Affected systems

nvm (Node Version Manager) through version 0.40.4 as distributed by the OpenJS Foundation is affected. Any system using nvm to install or manage Node.js versions is potentially vulnerable if: (1) it is configured to use a non-default mirror, (2) the mirror connection is not over HTTPS, or (3) the user's network is subject to man-in-the-middle attacks. The default mirror configuration (https://nodejs.org) mitigates the risk for standard deployments. Users on versions 0.40.4 and earlier should prioritize upgrading.

Exploitability

Exploitability is moderate in real-world scenarios despite the technical simplicity. An attacker must either control the mirror server, intercept unencrypted mirror traffic, or convince a user to explicitly configure a malicious mirror. The CVSS score of 7.5 (HIGH) reflects the high impact (confidentiality, integrity, availability) balanced against the requirement for network-level access (AV:N/AC:H) and user interaction in some scenarios (UI:R). The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog, but the attack surface widens significantly in CI/CD environments where mirror configurations may be centralized and automation reduces friction.

Remediation

Upgrade nvm to a version incorporating the security fixes from the master branch once a tagged release becomes available. Verify the updated version against the OpenJS Foundation's official release channels. In the interim, immediately audit your nvm configuration: confirm you are using the default https://nodejs.org mirror, or if you are using a custom mirror, verify it is accessed over HTTPS with valid certificates and is controlled by a trusted entity. Disable or restrict access to non-default mirrors in shared CI/CD environments. Consider enforcing mirror configuration via centralized tooling to prevent user misconfiguration.

Patch guidance

Monitor the nvm GitHub repository and OpenJS Foundation release notes for the next tagged release that incorporates the master branch fixes. Once released, upgrade by pulling the latest version using your current nvm installation method (typically via the installation script or package manager). Verify the upgrade completed by running `nvm --version` and confirming the version number has incremented. For CI/CD environments, update base images and automated provisioning scripts to use the patched version. Test node installation workflows in a non-production environment before deploying to production pipelines. Coordinate timing with your development and infrastructure teams to minimize disruption.

Detection guidance

Monitor command execution logs on systems running nvm for suspicious shell escapes or unusual awk invocations that correlate with `nvm install` or related version-management commands. If you use a custom mirror, audit its access logs and index.tab file for unexpected version strings containing shell metacharacters ($(), ``, |, ;) or awk commands (system(), etc.). In CI/CD platforms, monitor build logs for unexpected commands executed during the version installation phase. Network-level detection is limited unless you inspect unencrypted mirror traffic; if you are using a non-HTTPS mirror, this is a strong indicator of potential exposure and should trigger immediate investigation.

Why prioritize this

Although nvm is not yet in the CISA KEV catalog, this vulnerability merits immediate prioritization for organizations using non-default mirrors or CI/CD automation. The ease of exploitation once an attacker gains mirror access, the critical nature of the nvm tool in development workflows, and the potential for supply chain impact justify urgent patching. The HIGH CVSS score and the breadth of affected deployment scenarios—particularly in containerized and automated build environments—compound the risk. Prioritize patching for any nvm installations in CI/CD pipelines and shared development infrastructure first, followed by individual developer workstations.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) balances high impact across confidentiality, integrity, and availability with moderate attack complexity and network-level access requirements. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R reflects that an attacker needs network access but faces high complexity in exploiting most users (due to default-mirror protection), and successful exploitation in some scenarios requires user interaction (selecting a non-default mirror or accepting a man-in-the-middle scenario). However, the impact once achieved is severe—arbitrary command execution—warranting the HIGH rating. In CI/CD and automated scenarios where mirror configuration is centralized and attacker motivation is high, the practical exploitability is higher than the score suggests.

Frequently asked questions