CVE-2026-94185
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
nvm before 0.40.8 is vulnerable to path traversal in nvm_alias(), where a requested version or alias is treated as a filename under $NVM_DIR/alias without containment checks. A name containing '..' allows reading the first non-comment line of any file readable by the user, e.g. via .nvmrc in an untrusted repository. There is no integrity or availability impact and no code execution.
Risk Assessment
A developer running 'nvm use', 'nvm install', or 'nvm which' inside an untrusted repository may disclose sensitive file contents (e.g. .npmrc) in the error message. The risk is information disclosure, not code execution.
Recommendation
Update nvm to version 0.40.8 or later. Avoid running nvm commands in untrusted repositories until patched.
Other vulnerabilities in nvm
See all- CVE-2026-118905High
In nvm versions 0.31.2 through 0.40.5, nvm_ls filters installed versions with a sed program that embeds the requested version pattern in a \#...# address, escaping . and # but not backslash. A version string containing # closes the address early and the rest is parsed as sed commands, allowing shell command execution with GNU sed or file read/write with BSD sed.
- CVE-2026-15921Low
Node Version Manager (nvm) versions 0.32.1 through 0.40.5 are vulnerable to path traversal when parsing LTS codenames from a mirror. A malicious mirror can inject path sequences like "../../../.bashrc", causing nvm to write version strings outside the intended alias directory, potentially overwriting shell startup files.
- CVE-2026-10796High
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. An attacker who controls the mirror or performs a man-in-the-middle attack on a non-TLS connection can run arbitrary commands on the victim's system.
Original NVD description (English source)
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS