CVE-2026-121751
Description
A flaw was found in Node Version Manager (nvm). Remote version data retrieved from a mirror is stored without sufficient validation and later evaluated during shell arithmetic operations. An attacker controlling a malicious or compromised mirror can provide crafted version strings that trigger arbitrary command execution with the privileges of the local user when affected nvm commands or new shell sessions are run.
Statement
This vulnerability is rated as having an Important impact because successful exploitation permits arbitrary command execution in the context of the executing user. While shell arithmetic evaluation can trigger execution during normal command invocations or new shell startups, exploitation depends on significant prerequisites such as network traffic interception or interacting with a hostile mirror. Red Hat Enterprise Linux does not distribute the Node Version Manager utility, relying instead on official Node.js application streams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict input validation on version strings and block non-digit suffixes from entering bash and zsh shell arithmetic evaluation in nvm: upgrade to nvm 0.41.0, which discard index.tab rows lacking strictly formatted version strings and return non-digit suffixes unchanged without entering arithmetic evaluation, closing all 4 injection vectors (compromised or hostile mirror index.tab, man-in-the-middle network tampering of HTTP mirror traffic, malicious NVM_NODEJS_ORG_MIRROR environment variable, untrusted project .nvmrc file). Until patched, this is only a concern on bash and zsh shell environments running affected nvm installations — dash shell environments are unaffected — so use only trusted Node.js mirrors over TLS, audit the NVM_NODEJS_ORG_MIRROR environment variable, and avoid running nvm commands or spawning shells in untrusted directories containing .nvmrc files. These controls limit blast radius and contain exploitation, but they do not fix the underlying shell arithmetic command injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
