Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-94185— nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

Quick assessment

Affected
nvm-sh nvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

nvm 在解析请求的版本或别名时，会将其视为 目录下的一个文件名。在 0.40.8 之前， 函数将请求的名称直接拼接到该目录路径之后，并直接读取结果，未进行任何路径包含性检查。因此，若名称中包含 组件，便可逃逸出别名目录；在默认目录结构下，诸如 这样的别名将解析为用户主目录中的一个文件。随后， 函数会输出所打开文件中的所有非注释、非空行。 由于来自不可信 文件的版本字符串会经过此代码路径，因此当开发者在攻击者提供的仓库中执行 、 或 命令时，会在生成的“尚未安装”错误消息中泄露该用户可读的任意文件的首行非注释内容。

CVSS 5.5 · Medium

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94185

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
Source: CVE Program / CVE List V5
Vulnerability Description
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nvm-sh nvm 0 ~ 0.40.7 -

II. Public POCs for CVE-2026-94185

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94185

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-94185 (1)

IV. Related Vulnerabilities

Same product: nvm
Same vendor: nvm-sh
Same weakness: CWE-22

V. Comments for CVE-2026-94185

No comments yet

Leave a comment