mirror of
https://github.com/nvm-sh/nvm.git
synced 2026-07-18 12:58:21 +08:00
A mirror-supplied LTS codename (field 10 of index.tab) was used verbatim as an alias filename, so a hostile codename such as `../../../.bashrc` could make nvm_make_alias write outside $NVM_DIR/alias - with the default layout, into shell startup files. Constrain remote codenames to safe filename characters at ingestion in nvm_ls_remote_index_tab, and reject any `..` path component in nvm_make_alias as a backstop for every caller.