A command injection vulnerability exists in the Node Version Manager, where the NVM_AUTH_HEADER environment variable is not sanitized in the wget code path used by nvm_download(). The function uses eval to execute wget commands, allowing an attacker to inject arbitrary shell commands that run when any nvm command that triggers a download is executed, such as "nvm install" or "nvm ls-remote". This flaw corresponds to CWE‑78 and CWE‑95, providing a means for an attacker to execute code with the privileges of the user running nvm.

The vulnerability affects the nvm-sh:nvm product in versions 0.40.3 and earlier. The official fix is included in version 0.40.4 and later, which sanitizes NVM_AUTH_HEADER in the wget code path via nvm_sanitize_auth_header().

The CVSS score of 5.4 indicates a medium severity, and the EPSS score of less than 1% shows a very low probability of exploitation overall. It is not listed in the CISA KEV catalogue. Exploitation requires an attacker to influence the victim’s shell environment so that a malicious NVM_AUTH_HEADER value is set, which could occur through compromised script files, CI/CD configurations, or poorly secured Docker images. Once the environment variable is set, any user who runs an nvm command that triggers a download will execute the injected shell commands with that user’s permissions.