nvm path traversal in alias resolution before 0.40.8
nvm before 0.40.8 concatenates unvalidated alias names onto $NVM_DIR/alias in nvm_alias(), allowing path traversal reads outside that directory.
- Vendor
- nvm-sh
- Product
- nvm (Node Version Manager)
- CVSS
- 5.5
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
Is CVE-2026-94185 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-94185 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-94185 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
nvm_alias() resolves a version alias by reading a file under $NVM_DIR/alias. Versions before 0.40.8 concatenated the caller-supplied alias name onto that path without validation, making it possible to read files outside $NVM_DIR by passing a crafted name with path separators.
The vulnerability has a local or limited-network attack vector, reflected in the CVSS 5.5 (medium) rating. Exposure is higher in shared CI/CD environments where alias strings may originate from external inputs such as pull request metadata or third-party config files.
Fix: Update nvm to 0.40.8 or later. The patch validates alias names before path concatenation. No workaround is available short of the update.
Source: GHSA-8grh-q73j-ffrc | nvm releases
