CVE-2026-94185: nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

Published Sep 21, 2026
·
Updated

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default layout an alias such as ../../.npmrc resolves to a file in the user's home directory. nvmprintaliasfile() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs nvm use, nvm install, or nvm which inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied nvm alias <traversing-name> discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

Affected Software

2 affected components
nvm nvm<0.40.8
nvm nvm_print_alias_file

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade nvm to a version that resolves this vulnerability.

    Fixed in 0.40.8

Event History

Sep 21, 2026
CVE Published
via MITRE·02:27 AM
Data Sourced
via MITRE·02:27 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:16 AM
DescriptionSeverityWeakness
Sep 25, 58691
Event
via NVD·06:36 AM

Frequently Asked Questions

1

Who is realistically exposed to this issue?

Developers are exposed when they run nvm use, nvm install, or nvm which inside an attacker-supplied repository containing an untrusted .nvmrc. The issue can disclose files readable by the user running nvm.

2

Does exploitation require any privileges or command execution?

No privileges are required, but exploitation requires user interaction: the user must run one of the affected nvm commands in a repository with an attacker-controlled .nvmrc. This path does not provide command execution, integrity impact, or availability impact.

3

What information can be disclosed?

A traversing alias can escape $NVM_DIR/alias and read an arbitrary file readable by the invoking user. Through an untrusted .nvmrc, the resulting error message discloses the first non-comment, non-empty line; a user-supplied nvm alias command can disclose every non-comment, non-empty line.

4

Are default installations affected?

Yes. Under the default layout, an alias such as ../../.npmrc escapes the alias directory and resolves to a file in the user's home directory.

5

What can be done before updating?

Do not run nvm use, nvm install, or nvm which in untrusted repositories or where the .nvmrc file is not trusted. Avoid supplying alias names containing .. components.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203