Executive brief
nvm is a bash script that manages multiple versions of Node.js. Before version 0.40.8, nvm's alias resolution failed to validate user input for path traversal sequences like `..`, allowing attackers to read arbitrary files readable by the user. A developer cloning or entering a repository with a malicious `.nvmrc` file, or running `nvm alias` with a crafted name, could leak sensitive files such as SSH keys, cloud credentials, or API tokens to the terminal output.
Technical details
The vulnerability is a path traversal flaw in the nvm_alias() function and nvm_process_nvmrc() boundary where alias names are concatenated directly onto $NVM_DIR/alias/ without validating for `..` or `/` characters. An attacker-controlled .nvmrc file or user-supplied alias name bypasses the containment check, allowing reads of arbitrary files. The flaw requires local execution (developer running nvm commands) but no elevated privileges; disclosed content reaches stdout/logs via error messages or full file dumps.
Affected products
- nvm nvm before 0.40.8
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Fix released in version 0.40.8