In versions 0.32.1 through 0.40.5, the nvm ls-remote command parses the LTS codename from mirror metadata and writes the alias file using that codename without sanitization. A malicious mirror can supply a codename that contains relative path components, such as '../../../.bashrc', causing nvm to create or overwrite files outside the expected alias directory. Overwriting shell startup files allows an attacker to inject code that will run in subsequent shell sessions, effectively giving remote code execution privileges to the user.

Node Version Manager, commonly known as nvm, a shell function for managing node.js versions, is affected in releases 0.32.1 through 0.40.5 of the nvm‑sh:nvm package. The vulnerability exists when the default ~/.nvm layout is used or when a non‑default mirror is configured via the NVM_NODEJS_ORG_MIRROR or NVM_IOJS_ORG_MIRROR environment variables. Users who rely on nvm ls‑remote, nvm install --lts, or other alias‑refreshing commands while pointing to an untrusted mirror are potentially impacted.

The CVSS score of 2.1 indicates low overall severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. However, because the flaw permits the attacker to write arbitrary files in the user’s home directory, including shell startup files, and can be triggered simply by invoking nvm ls‑remote against a malicious mirror, the strategic impact remains significant. The vulnerability is not listed in the CISA KEV catalog, but it remains a remote code execution risk when a hostile mirror is present. Attackers can compromise a mirror or perform a man‑in‑the‑middle attacks to supply the specially crafted LTS codename, then run any nvm command that refreshes aliases to achieve code execution, an inference based on the description.