← All credits

DavidCarliez reported the `nvm_download` eval sink

1 vulnerability record and advisories credit this contributor.

CVE-2026-10796
nvm executes commands from a malicious Node.js mirror's version strings