CVE-2026-85013
Fixed in a distro release EPSS <1%CVSS 7.3
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | environment-modules | 5.6.1-2.el10_2.1 |
| AlmaLinux 8 | environment-modules | 4.5.2-5.el8_10 |
| AlmaLinux 9 | environment-modules | 5.3.0-2.el9_8.1 |
| Debian 12 | modules | no fix |
| Debian 13 | modules | no fix |
| Debian 14 | modules | 5.6.1-3 |
| Red Hat Enterprise Linux 10.2 | environment-modules | 0:5.6.1-2.el10_2.1 |
| Red Hat Enterprise Linux 10.2 | environment-modules-debuginfo | 0:5.6.1-2.el10_2.1 |
| Red Hat Enterprise Linux 10.2 | environment-modules-debugsource | 0:5.6.1-2.el10_2.1 |
| Red Hat Enterprise Linux 8 | environment-modules | 0:4.5.2-5.el8_10 |
| Red Hat Enterprise Linux 8 | environment-modules-compat-debuginfo | 0:4.5.2-5.el8_10 |
| Red Hat Enterprise Linux 8 | environment-modules-debuginfo | 0:4.5.2-5.el8_10 |
| Red Hat Enterprise Linux 8 | environment-modules-debugsource | 0:4.5.2-5.el8_10 |
| Red Hat Enterprise Linux 9 | environment-modules | 0:5.3.0-2.el9_8.1 |
| Red Hat Enterprise Linux 9 | environment-modules-debuginfo | 0:5.3.0-2.el9_8.1 |
| Red Hat Enterprise Linux 9 | environment-modules-debugsource | 0:5.3.0-2.el9_8.1 |
| Red Hat hummingbird 1 | environment-modules | 0:5.6.2-1.hum1 |
| Rocky Linux 10 | environment-modules | 0:5.6.1-2.el10_2.1 |
| Rocky Linux 8 | environment-modules | 0:4.5.2-5.el8_10 |
| Rocky Linux 9 | environment-modules | 0:5.3.0-2.el9_8.1 |
| Ubuntu 16.04 LTS | modules | no fix |
| Ubuntu 18.04 LTS | modules | no fix |
| Ubuntu 20.04 LTS | modules | no fix |
| Ubuntu 22.04 LTS | modules | no fix |
| Ubuntu 24.04 LTS | modules | no fix |
| Ubuntu 26.04 LTS | modules | no fix |
| Ubuntu 26.10 | modules | no fix |