Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-85013

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Enterprise Linux 10

Default version status: affected

  • 0:5.6.1-2.el10_2.1 to < *unaffected

Red Hat Red Hat Enterprise Linux 8

Default version status: affected

  • 0:4.5.2-5.el8_10 to < *unaffected

Red Hat Red Hat Enterprise Linux 9

Default version status: affected

  • 0:5.3.0-2.el9_8.1 to < *unaffected

Red Hat Red Hat Hardened Images

Default version status: affected

  • 5.6.2-1.hum1 to < *unaffected

Red Hat Red Hat Enterprise Linux 6

Default version status: unknown

Red Hat Red Hat Enterprise Linux 7

Default version status: affected

References