CVE-2026-85013
A flaw was found in environment-modules.
Published Sep 15, 2026 · updated Oct 14, 2026
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's . When the victim uses Bash completion for or commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.
Timeline
Detection, updates, and resolution for this record.
Sep 15, 2026 · NIST NVD
Detected
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's . When the victim uses Bash completion for or commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting t
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's . When the victim uses Bash completion for or commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting t
Sources
- CVE.orgCVE-2026-85013
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-85013
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2026-85013
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's . When the victim uses Bash completion for or commands, the malicious module name, co
nvd.nist.gov