PatchTheCVECVE-2026-118905: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions
CVE-2026-118905 is a high-severity flaw (CVSS 7.0) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A version string containing `#` (or `\#`) therefore closes the address early, and the rest of it is parsed as sed commands: with GNU se
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-10-29 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-118905?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-118905 being exploited?
CVE-2026-118905 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-118905 affect?
CVE-2026-118905 affects affected software. Severity is high (CVSS 7.0). Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a
How urgent is CVE-2026-118905?
Priority 24/100. High severity