Node Version Manager stores the version column from a mirror’s index.tab file into a local alias file without validation. When the alias is later resolved, the suffix of an `lts/-N` value is evaluated as shell arithmetic. A crafted alias such as lts/-10*path[$(cmd)1] causes the command substitution to run arbitrary code in the user’s shell context. The vulnerability allows a malicious or compromised mirror, a man‑in‑the‑middle intercepting an http:// mirror, or a misconfigured NVM_NODEJS_ORG_MIRROR to execute commands when the user runs local nvm commands that resolve LTS aliases.

This flaw affects the nvm-sh:nvm client versions 0.39.6 through 0.40.8. The fix is included in nvm 0.41.0 which limits arithmetic evaluation to numeric offsets and removes rows with invalid version strings.

The CVSS score of 2.1 reflects the low base severity, but the vulnerability is exploitable only when the attacker can supply a hostile mirror or intercept an http mirror. It is not listed in the CISA KEV catalog, and EPSS is unavailable. When untrusted mirrors are avoided and nvm is run only from trusted project directories, exploitation risk is practically nil. However, in environments that pull from default mirrors over HTTPS the threat remains minimal, whereas using HTTP mirrors poses a higher risk of code execution.