[Fix] nvm_ls_remote_index_tab, nvm_remote_version, nvm_ls_cached: pass the version pattern to grep with -e

The requested version pattern was passed to grep as a bare argument,
so a pattern starting with `-` was parsed as grep options instead.
That pattern can come from a `.nvmrc` in a repository the user cloned,
or, for implicit aliases like `node` and `stable`,
from the version column of the mirror's index.tab.
A pattern like `-Rohenpm_[A-Za-z0-9]*` made GNU grep ignore the version list on stdin and search the current directory recursively,
following symlinks, so a string from a local file
(such as an npm token in a `.npmrc`) was taken as the "version", printed,
and requested from the mirror in the download URLs;
since the version list was never read, this also worked with `--offline`.
Pass the pattern after `-e` in `nvm_ls_remote_index_tab`
(which also covers `nvm_ls_remote`, `nvm_ls_remote_iojs`, and `nvm_remote_versions`),
in the post-check in `nvm_remote_version`, and in `nvm_ls_cached`,
so a leading `-` is just part of a pattern that matches no version.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-EN9DM7WC.
This commit is contained in:
Jordan Harband committed 2026-10-16 22:28:12 -07:00
1 parent 4049296ca8
commit bce663e387
2 files changed
+69 -3

No files matched your search

+3 -3
View File
@@ -1324,7 +1324,7 @@ nvm_remote_version() {
local VERSION_NUM
VERSION_NUM="$(nvm_echo "${VERSION}" | command awk '{print $1}')"
# the `v` prefix and the trailing non-digit keep `20` from matching `v10.20.0` or `v200.0.0`
if ! nvm_echo "${VERSION_NUM} " | nvm_grep -q "$(nvm_ensure_version_prefix "${PATTERN%.}")[^0-9]"; then
if ! nvm_echo "${VERSION_NUM} " | nvm_grep -q -e "$(nvm_ensure_version_prefix "${PATTERN%.}")[^0-9]"; then
VERSION='N/A'
fi
fi
@@ -2813,7 +2813,7 @@ EOF
}
prev=$10;
}' \
| nvm_grep -w "${PATTERN:-.*}" \
| nvm_grep -w -e "${PATTERN:-.*}" \
| $SORT_COMMAND; } << EOF
$VERSION_LIST
EOF
@@ -4600,7 +4600,7 @@ nvm_ls_cached() {
fi
} \
| command sed 's/^node-//' \
| nvm_grep -w "${NVM_CACHED_PATTERN}" \
| nvm_grep -w -e "${NVM_CACHED_PATTERN}" \
| nvm_grep -v "^${NVM_CACHED_RELEASE}-" \
| nvm_filter_installed_versions \
| nvm_sort_versions