---
id: CVE-2026-94185
title: >-
  nvm resolves a requested version or alias by treating it as a filename under
  $NVM_DIR/alias
summary: >-
  nvm resolves a requested version or alias by treating it as a filename under
  $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name
  onto that directory and read the result with no containment check, so a name
  containi…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
  - CWE-200
vendor: nvm-sh
product: nvm
affected:
  - nvm <= 0.40.7
published: '2026-09-21'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:56:19.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94185'
references:
  - url: 'https://github.com/nvm-sh/nvm/security/advisories/GHSA-8grh-q73j-ffrc'
    label: 7ffcee3d-2c14-4c3e-b844-86c6a321a158
tags:
  - nvd
  - cve.org
epss: 0.00221
epssPercentile: 0.11333
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T14:45:08.529950Z'
ingestedAt: '2026-09-21T03:30:44.991Z'
---

## Overview

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.