`install_nvm_from_git` checked whether `$NVM_INSTALL_VERSION` is a ref with a bare `git ls-remote`,
which discovers and loads the config of whatever repository contains the current directory.
That repository's `url.*.insteadOf` and `core.sshCommand` could then redirect or hijack the check,
unlike every other git command in the function,
which already passes `--git-dir="$INSTALL_DIR"/.git`.
Pass `--git-dir` here too;
`ls-remote` works even when that directory does not exist yet,
as on a fresh install
Discovered by Anthropic's OSS Scanner, as ANT-2026-JS4YHKRK; the scanner reported it as a vulnerability, but it is not one.
Jordan Harband
00217de1e1