Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-101032navi through 2.24.0 OS Command Injection via Cheatsheet Variables
High 7.0
In plain English
A high-severity OS command injection in navi from denisidoro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| denisidoro | navi | 0 – through 2.24.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Issue #1037 issue-tracking
- https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/commands/core/actor.rs#L159-L193 technical-description
- https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/common/shell.rs#L39-L50 technical-description
- https://github.com/denisidoro/navi product
- VulnCheck Advisory: navi through 2.24.0 OS Command Injection via Cheatsheet Variables third-party-advisory