The vulnerability in nvm (Node Version Manager) versions 0.32.1 through 0.40.5 involves improper validation of LTS codename fields obtained from the node.js mirror's index.tab file. Commands like 'nvm ls-remote' and 'nvm install --lts' use these codenames as filenames for alias files without sanitizing path traversal sequences. A malicious or compromised mirror can supply a codename containing path traversal characters (e.g., '../../../.bashrc'), causing nvm to write alias files outside the intended $NVM_DIR/alias directory, potentially overwriting critical user files such as shell startup scripts. Exploitation requires the user to run affected commands while configured to use a hostile mirror or under a man-in-the-middle attack. This vulnerability is fixed in nvm version 0.40.6 by validating and rejecting unsafe path components in LTS codenames.

An attacker controlling or intercepting the node.js mirror responses can cause nvm to write files outside its intended directory, including overwriting user shell startup files. This can lead to arbitrary code execution when the user starts a new shell session. The vulnerability requires user interaction with affected nvm commands and use of a malicious or compromised mirror. The CVSS score is low (2.1) reflecting the need for user action and specific conditions for exploitation.

Upgrade nvm to version 0.40.6 or later, which includes validation of remote LTS codenames to prevent path traversal. Until upgrading, avoid using untrusted or compromised mirrors and do not run affected commands with a hostile mirror configured. Patch status is not explicitly stated in the vendor advisory, but version 0.40.6 contains the fix. Check the official nvm repository or vendor advisory for the latest remediation guidance.