From 0333df56caaa91261788eb2b0d8dbb7f97ecd421 Mon Sep 17 00:00:00 2001 From: Jordan Harband Date: Sun, 18 Oct 2026 23:18:01 -0700 Subject: [PATCH] [Robustness] `install.sh`, `nvm uninstall`: pass the version to grep with `-e` `install_nvm_from_git` passed `$NVM_INSTALL_VERSION` to grep as a bare argument, and `nvm uninstall` did the same with the resolved version when looking for aliases that point to it, so a value starting with `-` would have been parsed as grep options rather than as the pattern. Neither value crosses a trust boundary (the first is the user's own environment variable, and the second is an already-installed version, which never starts with `-`), but every grep that receives a version should put it after `-e`, which POSIX specifies and which nvm.sh already uses elsewhere Discovered by Anthropic's OSS Scanner, alongside vulnerability ANT-2026-EN9DM7WC; this change is not itself a vulnerability fix. --- install.sh | 2 +- nvm.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/install.sh b/install.sh index 3ae0bd31..0b69d205 100755 --- a/install.sh +++ b/install.sh @@ -157,7 +157,7 @@ install_nvm_from_git() { NVM_VERSION="${NVM_INSTALL_VERSION:-$(nvm_latest_version)}" if [ -n "${NVM_INSTALL_VERSION:-}" ]; then # Check if version is an existing ref - if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q "$NVM_VERSION" ; then + if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q -e "$NVM_VERSION" ; then : # Check if version is an existing changeset elif ! nvm_download -o /dev/null "$(nvm_source "script-nvm-exec")"; then diff --git a/nvm.sh b/nvm.sh index 6b547fb6..db84d5ac 100755 --- a/nvm.sh +++ b/nvm.sh @@ -4741,7 +4741,7 @@ nvm() { nvm_echo "${NVM_SUCCESS_MSG}" # rm any aliases that point to uninstalled version. - for ALIAS in $(nvm_grep -l "${VERSION}" "$(nvm_alias_path)"/* 2>/dev/null); do + for ALIAS in $(nvm_grep -l -e "${VERSION}" "$(nvm_alias_path)"/* 2>/dev/null); do nvm unalias "$(command basename "${ALIAS}")" done ;;