CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

EUVD-2026-83825

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-94185

CVE-2026-94185 is a path traversal vulnerability in nvm (Node Version Manager) affecting versions before 0.40.8 . The function nvm_alias() concatenates a requested version or alias name onto $NVM_DIR/alias and reads the result with no containment check , so a name containing a .. component escape...

CVE-2026-94185: Improper Limitation of a Pathname to a Restricted Directory

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...