CVE-2026-85013
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a loca…
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.
Why it matters
- ▸ Requires local access, limiting mass exploitation
- ▸ Low attack complexity — no special conditions needed to exploit
- ▸ Requires low-privilege access first
- ▸ Requires the victim to take an action (e.g. open a file or link)
Apply the vendor patch as soon as it's available or already released. Review and restrict accounts with the privilege level this vulnerability requires. User-awareness training reduces risk here, since exploitation depends on tricking a user into acting.
This analysis is generated from structured CVSS vector data, CISA KEV cross-referencing, and vendor/product category rules — not a manual expert review. Treat it as a starting point, not a substitute for your own assessment.
CVSS Vector Breakdown
EU Vulnerability Database (ENISA)
EUVD is ENISA's EU vulnerability database, still in beta. EPSS is a probabilistic exploitation-likelihood score, not a certainty.
Stay Updated
New CVEs and vulnerability advisories are added continuously as they're disclosed. Subscribe via RSS to get every update the moment it's published — no email or account required.
Subscribe via RSS