CVE-2026-94185: nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default layout an alias such as ../../.npmrc resolves to a file in the user's home directory. nvmprintaliasfile() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs nvm use, nvm install, or nvm which inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied nvm alias <traversing-name> discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nvmto a version that resolves this vulnerability.Fixed in 0.40.8
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Developers are exposed when they run nvm use, nvm install, or nvm which inside an attacker-supplied repository containing an untrusted .nvmrc. The issue can disclose files readable by the user running nvm.
Does exploitation require any privileges or command execution?
No privileges are required, but exploitation requires user interaction: the user must run one of the affected nvm commands in a repository with an attacker-controlled .nvmrc. This path does not provide command execution, integrity impact, or availability impact.
What information can be disclosed?
A traversing alias can escape $NVM_DIR/alias and read an arbitrary file readable by the invoking user. Through an untrusted .nvmrc, the resulting error message discloses the first non-comment, non-empty line; a user-supplied nvm alias command can disclose every non-comment, non-empty line.
Are default installations affected?
Yes. Under the default layout, an alias such as ../../.npmrc escapes the alias directory and resolves to a file in the user's home directory.
What can be done before updating?
Do not run nvm use, nvm install, or nvm which in untrusted repositories or where the .nvmrc file is not trusted. Avoid supplying alias names containing .. components.