nvm evaluates a malicious mirror's index.tab version strings as shell arithmetic via stored LTS aliases

Overview

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote (and other commands that refresh remote LTS aliases) store the version column of the mirror's index.tab in $NVM_DIR/alias/lts/ without validating it, and nvm_normalize_lts later evaluates any suffix of an lts/-N value inside shell arithmetic $((N+1)). Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as lts/-10*path[$(cmd)1] runs cmd as the user when the alias is later resolved by purely local commands (nvm ls, nvm alias, nvm use --lts, nvm which lts/), and in every new shell when the default alias is lts/*. Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an http:// mirror, or a maliciously configured NVM_NODEJS_ORG_MIRROR -- and to run an affected command. The same sink is also reachable from a project .nvmrc, which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit lts/-N offset to arithmetic and drops index.tab rows whose version is not a valid version string.

Affected

• nvm >= 0.39.6 < 0.41.0

Remediation

Upgrade to nvm 0.41.0 or later, which only lets an all-digit lts/-N offset reach shell arithmetic and drops mirror rows with invalid version strings. (Only needed if using a non-default mirror whose metadata contents you do not trust, or running nvm in untrusted project directories.)

Workarounds

Until upgrading, only run nvm ls-remote and LTS-refreshing commands against trusted mirrors over TLS, ensure NVM_NODEJS_ORG_MIRROR points only at a trusted endpoint, and do not run nvm in untrusted project directories.