CVE-2026-121750 | nvm-sh nvm up to 0.40.x Cache SHASUMS256.txt nvm_download_artifact NVM_DIR code injection

November 5, 2026 Yanac

A vulnerability was found in nvm-sh nvm up to 0.40.x. It has been declared as problematic. This issue affects the function nvm_download_artifact of the file SHASUMS256.txt of the component Cache. Executing a manipulation of the argument NVM_DIR can lead to code injection.

This vulnerability appears as CVE-2026-121750. The attack may be performed from remote. There is no available exploit.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More