The vulnerability arises from the way nvm_ls builds a sed expression to filter installed Node.js versions. It embeds the requested version pattern directly into a sed address, escaping only certain characters while leaving backslashes unescaped. An attacker‑controlled version string that contains a hash or escaped hash terminates the address early, allowing the remainder of the string to be interpreted as sed commands. On systems using GNU sed, the e subcommand executes the supplied string as a shell command with the current user’s privileges. On BSD sed, the w and r commands can abuse file access. Because nvm_ls is invoked by many public commands (nvm use, nvm which, nvm run, etc.) and is also called by auto‑switch hooks that read .nvmrc files, the flaw lets an attacker trigger arbitrary command execution whenever they can influence a version string.

Affected supply is Node Version Manager (nvm) maintained by nvm-sh. Vulnerable releases are 0.31.2 through 0.40.5, inclusive. Functions impacted are nvm use, which, nvm ls, nvm version, nvm run, nvm exec, and the nvm-exec wrapper via the NODE_VERSION environment variable. The problem also affects users who have the bash cdnvm or zsh load‑nvmrc auto‑switch hooks, which feed directory‑level .nvmrc files directly into nvm ls and nvm version. Version 0.40.6 and later neutralise the vulnerability by stripping # characters and newlines before the string reaches the sed program.

The technical rating is CVSS 7.1, a high‑moderate severity indicating significant damage potential. The EPSS score is currently unavailable, so the immediate risk cannot be quantified, but the flaw is exploitable from any directory where a malicious .nvmrc file can be placed or from the command line when a user supplies a crafted version argument. Because the attack uses local privileges, the effect is confined to the current user, yet an attacker who gains the ability to create or edit .nvmrc files or supply command‑line arguments can gain shell access or modify system state. The vulnerability is not listed in the CISA KEV catalogue, but the known exploitability through sed’s e command is well understood.