CVE-2026-85013— Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 environment-modules 中发现了一个漏洞。本地攻击者可以通过在受害者 可见的路径下放置一个恶意命名的模块文件来利用此漏洞。当受害者使用 Bash 自动补全功能执行 或 命令时，包含 shell 元字符的恶意模块名称会被当作命令执行。这可能导致在补全用户的 shell 中执行任意命令，从而影响其机密性、完整性和可用性。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
II. Public POCs for CVE-2026-85013
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85013
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85013 (2)
Other References for CVE-2026-85013 (1)
Same Patch Batch · Red Hat · 2026-09-15 · 9 CVEs total
| CVE-2026-85234 | 7.5 HIGH | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine |
| CVE-2026-75092 | 7.3 HIGH | Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld |
| CVE-2026-81303 | 6.3 MEDIUM | Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostnam |
| CVE-2026-91786 | 6.1 MEDIUM | Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvali |
| CVE-2026-81320 | 5.5 MEDIUM | Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level |
| CVE-2026-79705 | 4.5 MEDIUM | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outsi |
| CVE-2026-79699 | 4.4 MEDIUM | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacem |
| CVE-2026-91926 | 3.7 LOW | Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair en |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc -
CVE-2026-90996
Sssd: sssd: denial of service in nss responder via crafted z -
CVE-2026-90995
Sssd: sssd: local denial of service due to null pointer dere -
CVE-2026-90994
Sssd: sssd: denial of service via malformed pam v1 requests
Same vendor: Red Hat
-
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-79699
Podman: buildah: skopeo: containers/storage: malicious tar w -
CVE-2026-79705
Podman: buildah: buildah/copier: directory escape via crafte -
CVE-2026-91926
Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_ -
CVE-2026-91786
Gnome-shell: gnome-shell: out-of-bounds read in remote searc
Same weakness: CWE-78
-
CVE-2026-58502
githubtoplanguages: Command Injection via Issue Title in Dis -
CVE-2026-91853
TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os comman -
CVE-2026-91936
Flowise before 3.1.4 Script Injection via Docker Workflows -
CVE-2026-91931
Flowise before 3.1.4 Remote Code Execution via Custom MCP np -
CVE-2026-55158
Conflibot: Command injection via crafted pull request branch
V. Comments for CVE-2026-85013
No comments yet