nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed

Overview

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . (and, since 0.40.4, #) but not backslash. A version string containing # (or \#) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU sed, the e command runs a shell command as the user; with BSD sed, the w and r commands write and read files. This is reachable whenever an attacker-influenced version string is passed to nvm use, nvm which, nvm ls, nvm version, nvm run, or nvm exec, or to nvm-exec via NODE_VERSION, and at least one version is installed. nvm's own .nvmrc parser strips comments, so a bare nvm use is not affected; however, the bash cdnvm and zsh load-nvmrc auto-switch hooks documented in the README read .nvmrc as-is and pass it to nvm ls and nvm version, so a user with one of those hooks installed runs the attacker's command just by changing into a directory under a malicious .nvmrc; scripts that run nvm use "$(cat .nvmrc)" are affected the same way. Version 0.40.6 passes any version pattern containing # or a newline through the .nvmrc content parser first, so no # reaches the sed program.

Affected

• nvm >= 0.31.2 < 0.40.6

Remediation

Upgrade to nvm 0.40.6 or later.

Workarounds

Until upgrading, do not pass untrusted version strings to nvm, and use nvm's own .nvmrc handling (a bare nvm use) instead of reading .nvmrc yourself, including in shell auto-switch hooks.