CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
Path traversal in nvm allows attackers to disclose contents of arbitrary files outside the alias directory via crafted version strings or aliases.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-94185?
CVE-2026-94185 is a medium-severity path traversal vulnerability in nvm-sh nvm, published on 21 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
Which versions are affected by CVE-2026-94185?
How do I fix CVE-2026-94185?
No fix has been published for CVE-2026-94185 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-94185 being exploited?
There is no known exploitation of CVE-2026-94185 in the wild and no public exploit code.
Sources
Also known as GHSA-8grh-q73j-ffrc.