mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-10-27 01:05:20 +08:00
io.js versions were inserted into node's version list immediately before the `v4.0.0` line. Whenever node's filtered list did not contain that exact line, every io.js version was appended after all node versions, including newer ones, so `nvm_remote_version`'s `tail -1` could pick an io.js version over the latest matching node version. Node's list is sorted, so it is now split at the first version with a nonzero major, which keeps io.js versions between node v0.x and node v4+ regardless of which node versions the pattern matched Discovered by Anthropic's OSS Scanner, as ANT-2026-AKH0HYWD; the scanner reported it as a vulnerability, but it is not one.