CVE-2026-94185: nvm Path Traversal Vulnerability

CVE-2026-94185 Overview

CVE-2026-94185 is a path traversal vulnerability [CWE-22] in Node Version Manager (nvm) affecting versions before 0.40.8. The nvm_alias() function concatenates a requested alias name onto $NVM_DIR/alias and reads the resulting file without any containment check. An alias name containing .. components escapes the alias directory and resolves to arbitrary files readable by the invoking user. When a developer runs nvm use, nvm install, or nvm which inside an attacker-supplied repository containing a crafted .nvmrc, the resulting error message discloses the first non-comment line of the targeted file.

Critical Impact
A malicious .nvmrc in an untrusted repository leaks contents of sensitive files such as ~/.npmrc, SSH keys, or shell history to the terminal output during routine nvm commands.

Affected Products

nvm (Node Version Manager) versions prior to 0.40.8
Developer workstations invoking nvm use, nvm install, or nvm which on untrusted repositories
Any user account executing nvm alias with attacker-controlled input

Discovery Timeline

2026-09-21 - CVE-2026-94185 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94185

Vulnerability Analysis

The vulnerability resides in how nvm resolves version aliases stored under $NVM_DIR/alias. The nvm_alias() shell function accepts a requested alias name and constructs a file path by concatenating that name onto the alias directory. It then reads the resulting file without validating that the resolved path remains inside the alias directory.

When the requested name contains .. traversal components, the constructed path escapes into arbitrary locations on the file system. Under the default nvm layout, an alias such as ../../.npmrc resolves to a file in the user's home directory. The nvm_print_alias_file() function then emits every non-comment, non-empty line of the opened file.

The disclosure occurs through two paths. First, an untrusted .nvmrc file supplies a traversing version string that flows into this code path when a developer runs nvm use, nvm install, or nvm which. The tool prints the first non-comment line of the target file inside the resulting "is not yet installed" error message. Second, a user invoking nvm alias <traversing-name> directly discloses every non-comment line of the target file.

Root Cause

The root cause is missing path canonicalization and containment validation in nvm_alias(). The function trusts caller-supplied names without normalizing the resulting path or verifying that it remains inside $NVM_DIR/alias. This is a classic path traversal weakness [CWE-22].

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts a repository containing a malicious .nvmrc file whose version string encodes a relative path traversal, for example ../../.ssh/id_rsa. When a developer clones the repository and runs any standard nvm invocation inside it, the tool reads the referenced file and echoes its first non-comment line into the error output. Contents can then be exfiltrated through shell history, terminal recording, or shared screen sessions. There is no integrity impact, no availability impact, and no command execution on this path.

Detection Methods for CVE-2026-94185

Indicators of Compromise

.nvmrc files containing .. sequences or absolute path fragments rather than valid semantic version strings
Terminal output from nvm use, nvm install, or nvm which containing content resembling ~/.npmrc tokens, SSH key headers, or shell configuration lines
Shell history entries invoking nvm alias with names containing ../ traversal components

Detection Strategies

Scan repository contents for .nvmrc files whose contents do not match a valid Node version pattern such as ^v?\d+\.\d+\.\d+ or a known alias name
Audit developer workstations for installed nvm versions below 0.40.8 using nvm --version
Review shell command auditing telemetry for nvm invocations that produce unusually large or credential-like output

Monitoring Recommendations

Enable shell command logging on developer endpoints and forward events to a centralized data lake for correlation
Monitor for reads of sensitive files such as ~/.npmrc, ~/.ssh/*, and ~/.aws/credentials originating from bash processes executing nvm scripts
Flag Git clone or checkout operations followed immediately by nvm commands emitting content from user home directories

How to Mitigate CVE-2026-94185

Immediate Actions Required

Upgrade nvm to version 0.40.8 or later on all developer workstations and shared build hosts
Instruct developers to avoid running nvm use, nvm install, or nvm which inside untrusted repositories until patching is complete
Rotate any credentials that may have been disclosed if suspicious .nvmrc files or nvm alias invocations are found in audit logs

Patch Information

The fix is included in nvm 0.40.8. Upgrade instructions and the vulnerability disclosure are published in the GitHub Security Advisory GHSA-8grh-q73j-ffrc. Reinstall nvm using the official install script or update through your package manager, then verify the version with nvm --version.

Workarounds

Inspect every .nvmrc file before running any nvm command inside a cloned repository, treating unexpected content as hostile
Remove or unset NVM_DIR when working with untrusted code, or run nvm invocations inside an isolated container or ephemeral workspace
Restrict the invoking user account's read access to sensitive files such as SSH keys and cloud credentials where operationally feasible

bash

# Configuration example
# Upgrade nvm to a patched release
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.8/install.sh | bash
nvm --version   # verify 0.40.8 or later

# Validate a .nvmrc before use
grep -Ev '^\s*(#|$)' .nvmrc | grep -vE '^v?[0-9]+(\.[0-9]+){0,2}$' \
  && echo "Suspicious .nvmrc content - do not run nvm"