Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-94185: nvm can expose files outside its alias directory
CVE-2026-94185 · published 1 month ago
Summary
The nvm tool reads alias files without checking that the requested name stays within its own alias folder. If a malicious project supplies a specially crafted alias like "../../.npmrc", nvm will read and show the first line of that external file when a user runs commands such as "nvm use" or "nvm install". Upgrade nvm to version 0.40.8 or later to add the necessary safety checks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nvm-sh | nvm | <= 0.40.7 |
Original advisory text
nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94185... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-94185 Vendor Advisory
- https://github.com/nvm-sh/nvm Product
- https://github.com/nvm-sh/nvm/security/advisories/GHSA-8grh-q73j-ffrc Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-22Path Traversal
CWE-200Information Exposure
Timeline
Published21 Sep 2026
Updated4 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta