Vulnerability · Published Sep 15, 2026 · Assigned by redhat
CVE-2026-85013Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters
High 7.3
In plain English
A high-severity OS command injection in Red Hat Enterprise Linux 10 from Red Hat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | environment-modules | 5.6.1-2.el10_2.1 | ALSA-2026:80664 |
| AlmaLinux:8 | environment-modules | 4.5.2-5.el8_10 | ALSA-2026:82919 |
| AlmaLinux:9 | environment-modules | 5.3.0-2.el9_8.1 | ALSA-2026:84594 |
| Debian:12 | modules | no fix listed | DEBIAN-CVE-2026-85013 |
| Debian:13 | modules | no fix listed | DEBIAN-CVE-2026-85013 |
| Debian:14 | modules | 5.6.1-3 | DEBIAN-CVE-2026-85013 |
| Rocky Linux:10 | environment-modules | 0:5.6.1-2.el10_2.1 | RLSA-2026:80664 |
| Rocky Linux:8 | environment-modules | 0:4.5.2-5.el8_10 | RLSA-2026:82919 |
| Rocky Linux:9 | environment-modules | 0:5.3.0-2.el9_8.1 | RLSA-2026:84594 |
| Ubuntu:22.04:LTS | modules | no fix listed | UBUNTU-CVE-2026-85013 |
| Ubuntu:24.04:LTS | modules | no fix listed | UBUNTU-CVE-2026-85013 |
| Ubuntu:26.04:LTS | modules | no fix listed | UBUNTU-CVE-2026-85013 |
| Ubuntu:26.10 | modules | no fix listed | UBUNTU-CVE-2026-85013 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Hardened Images | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2026:64766 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80664 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:82919 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:84594 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-85013 vdb-entry, x_refsource_REDHAT
- RHBZ#2465635 issue-tracking, x_refsource_REDHAT
- https://github.com/envmodules/modules/security/advisories/GHSA-8hrw-p88g-qhmg