nvm path traversal in alias resolution before 0.40.8
nvm before 0.40.8 concatenates unvalidated alias names onto $NVM_DIR/alias in nvm_alias(), allowing path traversal reads outside that directory.
- Vendor
- nvm-sh
- Product
- nvm (Node Version Manager)
- CVSS
- 5.5
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
nvm_alias() resolves a version alias by reading a file under $NVM_DIR/alias. Versions before 0.40.8 concatenated the caller-supplied alias name onto that path without validation, making it possible to read files outside $NVM_DIR by passing a crafted name with path separators.
The vulnerability has a local or limited-network attack vector, reflected in the CVSS 5.5 (medium) rating. Exposure is higher in shared CI/CD environments where alias strings may originate from external inputs such as pull request metadata or third-party config files.
Fix: Update nvm to 0.40.8 or later. The patch validates alias names before path concatenation. No workaround is available short of the update.
Source: GHSA-8grh-q73j-ffrc | nvm releases
