CVE-2026-118905 | nvm-sh nvm up to 0.40.5 Sed Parser nvm_ls NODE_VERSION os command injection

SecurityVulns
Yanac

A vulnerability classified as problematic has been found in nvm-sh nvm up to 0.40.5. This affects the function nvm_ls of the component Sed Parser. This manipulation of the argument NODE_VERSION causes os command injection.

This vulnerability is tracked as CVE-2026-118905. The attack is restricted to local execution. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More