Node Version Manager (nvm) includes a flaw where a checksum mismatch during online download does not remove the rejected archive from its cache, and a subsequent offline install blindly uses that cached file without performing a checksum validation. This defect permits an attacker who can supply or modify the delivery of an archive – for example through a compromised CDN or a tampered cache object – to execute arbitrary code under the user’s shell when that user performs `nvm install --offline` after a failed checksum check. The weakness is an improper validation of cached artifacts (CWE-459 and CWE-494). The consequence is that any code contained in the malicious tarball is executed as the user who runs nvm, providing local code‑execution privileges.

The vulnerability affects the nvm project (Node Version Manager) under the vendor nvm-sh:nvm. Affected product versions are 0.40.5 through 0.40.8; the fix was introduced in version 0.41.0. All installations using those legacy versions are at risk until they are upgraded or the cache is cleared.

The CVSS score of 2.1 indicates low overall severity, but the lack of a checksum check during offline installation means the flaw escalates to code execution when an attacker can influence the contents of the tarball. The EPSS score is not available, which neither confirms nor excludes the likelihood of exploitation, yet the possibility of manual supply of a poisoned tarball gives the attacker sufficient control to trigger the vulnerability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no confirmed exploitation is known. Attackers would need local access to run nvm locally and influence the cached archive, making the attack vector a local, interactive scenario rather than an external network exploit.