CVE-2026-94185
Received Received - Intake

Path Traversal in nvm Leading to File Disclosure

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: harborist

Description
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94185
EUVD
EUVD-2026-83825

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nvm_sh nvm to 0.40.8 (exc)
nvm_sh nvm 0.40.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94185 is a path traversal vulnerability in Node Version Manager (nvm). It allows malicious .nvmrc files to read arbitrary files on a developer's system when commands like nvm use are executed. The issue occurs because nvm does not properly validate alias names or version strings from untrusted .nvmrc files, enabling path traversal sequences to escape the restricted alias directory and access sensitive files.

Detection Guidance

Check your nvm version with nvm --version. If it is below 0.40.8, the system is vulnerable. Review .nvmrc files in repositories for path traversal sequences like ../../ or similar patterns. Test by creating a malicious .nvmrc with a path traversal payload and running nvm use to see if sensitive files are disclosed in error messages.

Impact Analysis

This vulnerability can lead to the disclosure of sensitive files such as credentials, configuration files, or other data stored near the nvm directory. Attackers can exploit it by tricking users into running commands in a malicious repository or using a crafted alias, potentially exposing files like ~/.ssh/id_rsa, ~/.aws/credentials, or .env files.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive files containing personal or confidential data, such as configuration files or credentials. Such disclosures may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) or HIPAA (e.g., exposure of protected health information). The impact depends on the files accessed and the organization's compliance obligations.

Mitigation Strategies

Upgrade nvm to version 0.40.8 or later immediately. Avoid running nvm commands in untrusted directories or repositories. Review and remove any suspicious .nvmrc files. Monitor for unusual file access patterns or error messages that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94185. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart