openjsf node version manager vulnerabilities

Latest openjsf node version manager CVEs

Newest publication first

1. CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings

   Published 2026-06-04

   High·CVSS 7.5

   nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.