Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, "nvm ls-remote" (and other commands that refresh remote LTS aliases) store the version column of the mirror's "index.tab" in "$NVM_DIR/alias/lts/" without validating it, and "nvm_normalize_lts" later evaluates any suffix of an "lts/-N" value inside shell arithmetic "$((N+1))". Under bash and zsh, arithmetic evaluation expands command substitutions in array subscripts, so a stored value such as "lts/-10*path[$(cmd)1]" runs "cmd" as the user when the alias is later resolved by purely local commands ("nvm ls", "nvm alias", "nvm use --lts", "nvm which lts/"), and in every new shell when the "default" alias is "lts/*". Exploitation requires the victim to use a hostile mirror -- via a compromised mirror or CDN, a network man-in-the-middle of an "http://" mirror, or a maliciously configured "NVM_NODEJS_ORG_MIRROR" -- and to run an affected command. The same sink is also reachable from a project ".nvmrc", which is treated as hardening. dash is not affected. Version 0.41.0 only passes an all-digit "lts/-N" offset to arithmetic and drops "index.tab" rows whose version is not a valid version string.