Description

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-21T03:16:34.243Z",
  "pubdate": "2026-09-21T03:16:34.243Z",
  "executiveSummary": "A path traversal vulnerability exists in nvm versions prior to 0.40.8, stemming from insufficient input validation when resolving version aliases. The vulnerability allows an attacker to read the contents of arbitrary files accessible to the user running nvm.\nThe flaw occurs because nvm_alias() fails to sanitize input, allowing directory traversal sequences (..) to escape the intended $NVM_DIR/alias directory. By supplying a malicious alias or an untrusted .nvmrc file, an attacker can coerce the application into reading sensitive system or user configuration files.\nThe primary impact is unauthorized information disclosure of file contents via nvm error messages or alias output. There is no potential for remote code execution, system integrity compromise, or availability disruption. Successful exploitation requires the victim to execute nvm commands, such as 'nvm use', 'nvm install', or 'nvm alias', within the context of an attacker-controlled repository or via a manipulated alias name. This vulnerability is particularly critical for developers who may trigger nvm commands automatically when navigating into compromised directories.",
  "technicalDetails": "The root cause of this vulnerability is improper path sanitization in the nvm_alias() function within the nvm codebase. When a user requests a version or alias, nvm attempts to resolve the request by treating it as a filename located within the $NVM_DIR/alias directory. Prior to version 0.40.8, the implementation performed direct string concatenation of the requested name onto the alias directory path without verifying the absence of directory traversal sequences.\nSpecifically, the nvm_alias() function failed to implement containment checks, allowing an attacker to utilize '..' components to navigate outside the intended $NVM_DIR/alias boundary. Once the path resolution occurs, the nvm_print_alias_file() function is invoked, which reads the file at the resolved path and emits every non-comment, non-empty line. This resulting content is subsequently exposed in the nvm output, typically surfaced through error messages when a requested version is reported as 'not yet installed'.\nThe attack flow generally follows one of two vectors: First, in a repository-based attack, an attacker provides a malicious .nvmrc file in a project directory. When a victim executes 'nvm use', 'nvm install', or 'nvm which' within that directory, nvm reads the version string from the .nvmrc file. If the string contains a traversal sequence, nvm will attempt to open the target file, and the error message generated will disclose the first non-comment line of that file. Second, if an attacker has the ability to influence the user's local nvm configuration, they can execute 'nvm alias <traversing-name>', which causes the tool to read and display every non-comment line of the target file directly.\nThis vulnerability affects all versions of nvm prior to 0.40.8. It does not require special authentication or privileges, as the tool operates with the user's existing permissions. The exploit does not require network exposure, as it relies on local file system access by the nvm utility. The post-exploitation impact is limited to the disclosure of sensitive file contents that are readable by the local user, which may include tokens, credentials, or configuration data stored in files such as .npmrc or other user-specific dotfiles."
}