Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-21 | 1 | Patch1 |
| 2026-09-26 | 1 | General1 |
| 2026-10-23 | 1 | Patch1 |
https://nvm.sh v0.40.8 is out, fixing a path traversal vuln and a number of bugs - https://www.cve.org/CVERecord?id=CVE-2026-94185 - https://github.com/nvm-sh/nvm/releases/tag/v0.40.8
Post summary
nvm version 0.40.8 releases a fix for a path traversal vulnerability (CVE‑2026‑94185) and other bug fixes.
CVE-2026-94185 nvm path traversal (CVSS 5.5, unpatched): alias names with .. escape $NVM_DIR/alias, reading arbitrary home-dir files like .npmrc. No patch yet, so watch alias inputs and upgrade to 0.40.8+ when available. #CVE #infosec #nvm https://www.valtersit.com/cve/CVE-2026-94185/ #NVM #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet announces CVE-2026-94185, an nvm path traversal vulnerability (CVSS 5.5) where crafted alias names can escape $NVM_DIR/alias to read arbitrary files, and recommends upgrading to version 0.40.8+ when available as the remediation.
Details: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/94xxx/CVE-2026-94185.json
Post summary
The text consists solely of a link to the official CVE JSON record for CVE-2026-94185 on GitHub, providing no actionable intelligence regarding exploitation, patches, or technical specifics.