CVE-2026-94185 - nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias
Brief
CVE ID : CVE-2026-94185
Published : Sept. 21, 2026, 3:16 a. m.
- 1 hour, 41 minutes ago
Description : nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.
- 8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `.. ` component escaped the alias directory; under the default layout an alias such as `.. /.. /. npmrc` resolves to a file in the user's home directory.
nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .