Vulnerability · Published Jan 29, 2026 · Assigned by openjs

CVE-2026-1665Command Injection in nvm via NVM_AUTH_HEADER in wget code path

Medium 5.4

In plain English

A medium-severity OS command injection in nvm from nvm-sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 4.0)5.4Medium

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to execute wget commands, and the NVM_AUTH_HEADER environment variable was not sanitized in the wget code path (though it was sanitized in the curl code path). An attacker who can set environment variables in a victim's shell environment (e.g., via malicious CI/CD configurations, compromised dotfiles, or Docker images) can inject arbitrary shell commands that execute when the victim runs nvm commands that trigger downloads, such as 'nvm install' or 'nvm ls-remote'.

Affected products (as reported)

Vendor	Product	Versions
nvm-sh	nvm	0.40.0 – through 0.40.3

Weakness: CWE-78, CWE-95 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Fix commit patch
Release v0.40.4 release-notes
nvm GitHub repository product
https://github.com/nvm-sh/nvm/pull/3380 x_introduced