nvm (Node Version Manager) reads version strings from configured Node.js mirrors and uses them to build download URLs and shell/awk commands without sanitization. A crafted version field such as $(id) triggers command substitution in the evalled curl/wget string and in the awk system() call, allowing an attacker to run arbitrary commands with the privileges of the user executing nvm. The vulnerability is limited to the process of nvm and does not provide network or system‑wide privileges beyond those of the nvm invoker.

Any installation of nvm-sh:nvm through version 0.40.4 that utilizes a non‑default or potentially compromised mirror. This includes systems where the mirror URL has been manually changed, where an attacker controls the mirror, or where a man‑in‑the‑middle attack can alter mirror content. The default HTTPS endpoint https://nodejs.org is not affected, but any custom mirror configuration exposes the risk.

The CVSS score of 7.5 indicates high severity, while the EPSS is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker must influence the mirror to supply malicious version strings; this is feasible for users who have administrative access to the mirror or who can intercept traffic to a non‑TLS mirror. The exploit path is straightforward once the malicious content is injected, with a very low barrier to successful exploitation if the conditions are met.