Node Version Manager (nvm) versions 0.40.0 to 0.40.8 expose the value of the NVM_AUTH_HEADER environment variable by passing it to curl or wget as a --header "Authorization: ..." command-line argument. Because process arguments are visible to any local user via ps or /proc on Linux, or ps on macOS, an unprivileged account on the same host can capture the header while nvm performs actions such as nvm ls-remote or nvm install. This confidential authorization token can then be used to access private mirrors or repositories, effectively granting the attacker the same permissions that the token provides.

The vulnerability affects Node Version Manager (nvm) provided by nvm-sh, specifically releases 0.40.0 through 0.40.8. Users running these versions on machines shared with other local accounts are at risk. The issue persists on Linux unless the proc filesystem is mounted with hidepid=2, and on macOS it remains visible through ps. In environments where BusyBox wget is the sole downloader, the header is still passed as an, while GNU Wget or curl in version 0.41.0 or later mitigate the issue by using stdin or a private config file.

The CVSS base score of 2.0 classifies the flaw as low severity, and it is not listed in the CISA KEV catalog, indicating no known large-scale exploitation. However, the EPSS score is unavailable, so the exact likelihood cannot be quantified. Attackers can exploit the flaw by running legitimate nvm commands on a shared system; the exposure requires only that an attacker has a local user account and that curl or wget is installed. Because the vulnerability is local, it does not allow remote code execution but can lead to unauthorized access to private resources if the captured token is reused.