CVE-2026-121749 | nvm-sh nvm up to 0.40.x Remote Version Lookup os command injection

November 5, 2026 Yanac

A vulnerability classified as problematic was found in nvm-sh nvm up to 0.40.x. Affected by this issue is the function nvm_ls_remote_index_tab/nvm_remote_version/nvm_ls_cached of the component Remote Version Lookup. The manipulation results in os command injection.

This vulnerability is identified as CVE-2026-121749. The attack is only possible with local access. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More