nvm vulnerabilities

nvm before 0.40.8 is vulnerable to path traversal in nvm_alias(), where a requested version or alias is treated as a filename under $NVM_DIR/alias without containment checks. A name containing '..' allows reading the first non-comment line of any file readable by the user, e.g. via .nvmrc in an untrusted repository. There is no integrity or availability impact and no code execution.

Node Version Manager (nvm) versions 0.32.1 through 0.40.5 are vulnerable to path traversal when parsing LTS codenames from a mirror. A malicious mirror can inject path sequences like "../../../.bashrc", causing nvm to write version strings outside the intended alias directory, potentially overwriting shell startup files.

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. An attacker who controls the mirror or performs a man-in-the-middle attack on a non-TLS connection can run arbitrary commands on the victim's system.