Veille CVE

‹ Retour à la liste

CVE-2026-94185

5.5 Moyenne

Publiée le 21/09/2026 à 05:16 · Modifiée le 22/09/2026 à 21:56 · En attente d'analyse NVD · Source : 7ffcee3d-2c14-4c3e-b844-86c6a321a158

Description

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias <traversing-name>` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 6.7 Moyenne 7ffcee3d-2c14-4c3e-b844-86c6a321a158 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3.1 5.5 Moyenne 7ffcee3d-2c14-4c3e-b844-86c6a321a158 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Faiblesses (CWE)

Références

Ailleurs