Skip to content
Heist/ feed
Back to feed
Medium

nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

Type: advisorySources: OSV

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias ` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-94185
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 06:04 UTC · Revision 1

Source evidence

nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

core-osv · Original source

Published 21 Sept 2026, 02:27 UTC

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias ` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

osv:CVE-2026-94185
Complete source record
{
  "id": "331c220f8f33e3249a07da1388a4e8946aca7f48c908a38ea71edf70e84c348f",
  "url": "https://osv.dev/vulnerability/CVE-2026-94185",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias",
    "summary": "nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting \"is not yet installed\" error message. A user-supplied `nvm alias ` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.",
    "evidence": "osv:CVE-2026-94185",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-94185",
      "aliases": [
        "CVE-2026-94185",
        "GHSA-8grh-q73j-ffrc"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nvm-sh/nvm",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a885b885fef16fac4bc544188fb25e9e37ae83e8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.40.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.40.8"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.40.7",
            "v0.40.6",
            "v0.40.5",
            "v0.40.4",
            "v0.40.3",
            "v0.40.2",
            "v0.40.1",
            "v0.40.0",
            "v0.39.7",
            "v0.39.6",
            "v0.39.5",
            "v0.39.4",
            "v0.39.3",
            "v0.39.2",
            "v0.39.1",
            "v0.39.0",
            "v0.38.0",
            "v0.37.2",
            "v0.37.1",
            "v0.37.0",
            "v0.36.0",
            "v0.35.3",
            "v0.35.2",
            "v0.35.1",
            "v0.35.0",
            "v0.34.0",
            "v0.33.9",
            "v0.33.8",
            "v0.33.7",
            "v0.33.6",
            "v0.33.5",
            "v0.33.4",
            "v0.33.3",
            "v0.33.2",
            "v0.33.1",
            "v0.33.0",
            "v0.32.1",
            "v0.32.0",
            "v0.31.7",
            "v0.31.6",
            "v0.31.5",
            "v0.31.4",
            "v0.31.3",
            "v0.31.2",
            "v0.31.1",
            "v0.31.0",
            "v0.30.2",
            "v0.30.1",
            "v0.30.0",
            "v0.29.0",
            "v0.28.0",
            "v0.27.1",
            "v0.27.0",
            "v0.26.1",
            "v0.26.0",
            "v0.25.4",
            "v0.25.3",
            "v0.24.1",
            "v0.25.2",
            "v0.25.1",
            "v0.25.0",
            "v0.24.0",
            "v0.23.3",
            "v0.23.2",
            "v0.23.1",
            "v0.23.0",
            "v0.22.2",
            "v0.22.1",
            "v0.22.0",
            "v0.21.0",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.2",
            "v0.17.1",
            "v0.17.0",
            "v0.16.1",
            "v0.16.0",
            "v0.15.0",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.0",
            "v0.8.0",
            "v0.7.0",
            "v0.6.1",
            "v0.6.0",
            "v0.5.1",
            "v0.5.0",
            "v0.4.0",
            "v0.3.0",
            "v0.2.0",
            "v0.1.0",
            "v0.0.6",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94185.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.996040309Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94185.json",
        "https://github.com/nvm-sh/nvm/security/advisories/GHSA-8grh-q73j-ffrc",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-94185",
        "https://github.com/nvm-sh/nvm"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-200",
          "CWE-22"
        ],
        "cna_assigner": "harborist",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94185.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-94185",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 510946,
  "published_at": "2026-09-21T02:27:00.752+00:00"
}