The vulnerability (CVE-2026-15921) in nvm-sh's nvm affects versions 0.32.1 through 0.40.5. The `nvm ls-remote` and similar commands parse the node.js mirror's `index.tab` file and use the LTS codename field as an alias filename without proper validation. A malicious or compromised mirror can supply an LTS codename containing path traversal sequences (e.g., `../../../.bashrc`), causing nvm to write alias files outside the intended `$NVM_DIR/alias` directory. This can overwrite critical user files such as shell startup scripts, potentially leading to code execution in subsequent shell sessions. Exploitation requires the user to run an affected command while configured to use a hostile mirror. The issue is fixed in version 0.40.6 by validating and rejecting unsafe path components in LTS codenames.

An attacker controlling or intercepting the node.js mirror used by nvm can cause arbitrary files in the user's home directory to be created or overwritten by supplying malicious LTS codenames with path traversal sequences. This can lead to persistent code execution when the user starts a new shell session, by overwriting shell startup files. The vulnerability requires user interaction to run affected nvm commands and the use of a hostile mirror, limiting the attack scope. The CVSS score is low (2.1) reflecting these conditions.

Users should upgrade nvm to version 0.40.6 or later, which includes validation to reject unsafe LTS codename aliases and prevents path traversal. Until upgraded, users should avoid using untrusted or compromised mirrors and be cautious about network environments that could enable man-in-the-middle attacks on the mirror URL. Patch status is not explicitly confirmed in the advisory, but version 0.40.6 contains the fix. No other mitigations are specified.