File Path Traversal Vulnerability in NVM for Node.js

CVE-2026-94185

What is CVE-2026-94185?

The NVM (Node Version Manager) unintentionally allows for file path traversal attacks due to insufficient checks when resolving requested aliases against its directory structure. Specifically, before version 0.40.8, the nvm_alias() function inadequately validated user input, permitting aliases that contain traversal components (e.g., '..') to access files outside the designated alias directory. As a result, when executed in an untrusted repository, commands such as nvm use, nvm install, or nvm which can inadvertently expose sensitive contents of arbitrary files within the user's home directory, particularly in responses indicating that a requested version is not installed. This vulnerability emphasizes the necessity for proper input validation in software systems to mitigate potential disclosure of sensitive data.

References