ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6842

A flaw was found in nano.

Published Apr 22, 2026 · updated Sep 1, 2026

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the directory. This allows the attacker to inject a malicious launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 22, 2026 · NIST NVD

    Detected

    A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the directory. This allows the attacker to inject a malicious launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

  2. Sep 1, 2026 · NIST NVD

    Updated

    A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the directory. This allows the attacker to inject a malicious launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

Sources

  • CVE.orgVulnerability recordCVE-2026-6842

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-6842

    A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the directory. This allows the attacker to inject a malicious launcher, which could lead to unin

    nvd.nist.gov

References