Jordan Harband 6b9650c47f [Fix] bash_completion: list alias and version names without expanding them ...

`__nvm_generate_completion` passed its word list to `compgen -W`,
which runs every word through shell expansion.
Since that list includes alias file names and installed version directory names,
pressing Tab after `nvm use`, `nvm alias`, etc,
ran any command substitution in those names,
expanded variables in them, and globbed `*` against the current directory.
Now the list is split with globbing disabled,
and each word is matched against the current word as a literal prefix,
so names are offered exactly as written

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-QDARMGPO; the scanner correctly classified it as not a vulnerability.

2026-10-22 20:10:42 -07:00

2.6 KiB

Raw Permalink Blame History

View Raw