The vulnerability arises because the nvm tool, before version 0.40.8, concatenates a requested alias name directly onto the $NVM_DIR/alias directory without checking for path‑traversal components. An alias containing a .. segment allows exit from the intended directory, causing nvm to read arbitrary files that the user can access. When a library or .nvmrc file supplies such an alias, the first non‑comment line of the file is included in an error message, while directly calling nvm alias reveals every non‑comment line of the target file. This flaw does not alter the system state or execute code, but it leaks sensitive information such as configuration files or environment data, constituting an Information Exposure (CWE‑200) and Path Traversal (CWE‑22) weakness.

The affected product is the nvm‑sh/nvm JavaScript version manager. Any installation older than version 0.40.8 is vulnerable. Developers who run nvm commands—nvm use, nvm install, nvm which, or nvm alias—within a repository or configuration that contains a malicious alias or .nvmrc file are at risk.

The CVSS score of 6.7 places this flaw in the medium severity range. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack route requires local execution of an nvm command with an attacker‑controlled alias name or .nvmrc file; a local attacker or a malicious repository can trigger the disclosure. Because no elevated privilege or execution is required, exploitation risk is limited to the user’s own environment, but the information leaked can be valuable in social‑engineering or credential‑stealing scenarios.