CVE-2026-94185 PUBLISHED

nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

Assigner: harborist
Reserved: 21.09.2026 Published: 21.09.2026 Updated: 21.09.2026

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default layout an alias such as ../../.npmrc resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs nvm use, nvm install, or nvm which inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied nvm alias <traversing-name> discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.7

Product Status

Vendor nvm-sh
Product nvm
Versions Default: unaffected
  • affected from 0 to 0.40.7 (incl.)
  • Version 0.40.8 is unaffected

Solutions

Upgrade to nvm 0.40.8 or later, which rejects any .. path component in nvm_alias() and nvm_version_path().

Credits

  • vnth4nhnt of CyStack finder
  • SecFathy finder

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE