nvm 0.40.8 Blocks Malicious .nvmrc Path Traversal
Tech GuruQuick Answer
The nvm project published GHSA-8grh-q73j-ffrc for CVE-2026-94185. A malicious .nvmrc path could make nvm read outside its alias directory and disclose local files. Versions through 0.40.7 are affected; nvm 0.40.8 rejects the traversal.
Find Workflows That Automatically Trust .nvmrc Files
What to do now: Locate developer, CI, build, and shell-hook workflows that run nvm commands on repository-controlled .nvmrc files. Update to 0.40.8 or later, verify the active nvm installation, and review exposure of sensitive local files.
Last verified: 2026-09-21 UTC. Recheck the current authoritative advisory and entitled repository before changing production.
Scope And Authority
| Product scope | nvm releases through 0.40.7 |
|---|---|
| Advisory | GHSA-8grh-q73j-ffrc |
| CVE | CVE-2026-94185 |
| Authoritative release date | 2026-09-21 02:26:30 UTC; nvm 0.40.8 was released at 02:26:02 UTC |
| Authority revision date | 2026-09-21 02:26:30 UTC |
| Affected versions | nvm versions through 0.40.7 |
| Fixed version | 0.40.8 |
| CVSS base score | 5.5 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the nvm project; no exploitation claim is inferred. |
What Changed
The project states that crafted path traversal in an .nvmrc file can reach files outside $NVM_DIR/alias. The official CVSS vector requires local access and user interaction and rates confidentiality impact High; the advisory does not claim command execution or exploitation in the wild.
What To Validate Now
- Inventory. Locate nvm installations in developer workstations, administrative hosts, CI runners, images, and shell initialization or directory-change hooks.
- Establish applicability. Confirm versions through 0.40.7 and whether users or automation run
nvm use,nvm install, ornvm whichagainst untrusted repositories or files. - Remediate. Install nvm 0.40.8 or a supported later release through the project's documented method; rebuild managed images and CI runners where nvm is embedded.
- Validate. Confirm the active nvm version in every execution context, test approved
.nvmrcworkflows, and review whether untrusted repository content could have reached secrets before the update. - Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
nvm can exist per user and in multiple images or runners, so one successful update does not prove every execution context is fixed. Treat unexpected file access as a reason to investigate, not as proof that secrets were taken, and rotate credentials only according to evidence and incident-response policy.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, source advisory revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
