[Robustness] install.sh, nvm uninstall: pass the version to grep with -e

`install_nvm_from_git` passed `$NVM_INSTALL_VERSION` to grep as a bare argument,
and `nvm uninstall` did the same with the resolved version when looking for aliases that point to it,
so a value starting with `-` would have been parsed as grep options rather than as the pattern.
Neither value crosses a trust boundary
(the first is the user's own environment variable, and the second is an already-installed version, which never starts with `-`),
but every grep that receives a version should put it after `-e`,
which POSIX specifies and which nvm.sh already uses elsewhere

Discovered by Anthropic's OSS Scanner, alongside vulnerability ANT-2026-EN9DM7WC; this change is not itself a vulnerability fix.
This commit is contained in:
Jordan Harband committed 2026-10-23 08:53:59 -07:00
1 parent cbd8f8e920
commit 0333df56ca
2 files changed
+2 -2

No files matched your search

+1 -1
View File
@@ -157,7 +157,7 @@ install_nvm_from_git() {
NVM_VERSION="${NVM_INSTALL_VERSION:-$(nvm_latest_version)}"
if [ -n "${NVM_INSTALL_VERSION:-}" ]; then
# Check if version is an existing ref
if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q "$NVM_VERSION" ; then
if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q -e "$NVM_VERSION" ; then
:
# Check if version is an existing changeset
elif ! nvm_download -o /dev/null "$(nvm_source "script-nvm-exec")"; then