nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

Overview

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, when NVM_AUTH_HEADER is set, nvm_download passes the credential to curl or wget as a --header "Authorization: ..." command-line argument. Process arguments are visible to every local user (on Linux via ps or /proc//cmdline unless /proc is mounted with hidepid=; on macOS via ps), so another unprivileged account on the same machine can read the token while nvm is downloading during nvm ls-remote, nvm install, and similar commands, and gain whatever access it grants on the private mirror. Only users who set NVM_AUTH_HEADER on a host shared with other local accounts are affected. Version 0.41.0 passes the header to curl on stdin and to GNU Wget in a private temporary config file. BusyBox wget reads no config file, so when it is the only downloader available the header is still passed as an argument.

Affected

• nvm >= 0.40.0 < 0.41.0

Remediation

Upgrade to nvm 0.41.0 or later, and on a machine shared with other local users make sure curl or GNU Wget is installed (BusyBox wget still receives the header as an argument).

Workarounds

Until upgrading, do not set NVM_AUTH_HEADER on machines shared with other local users, or mount /proc with hidepid=2 on Linux.