CVE-2026-85013Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

Description

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Timeline

Scores

EPSS (exploitation in 30 days)

0.24% · top 85% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:5.6.1-2.el10_2.1 – < *

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:5.6.1-3.el10_3 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:4.5.2-5.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:5.3.0-2.el9_8.1 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:5.3.0-3.el9_9 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 5.6.2-1.hum1 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unknown

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

• Red Hat · Red Hat OpenShift AI (RHOAI)

  All versions: unknown

What to do

Workaround: To mitigate this issue, avoid enabling Bash completion for `module` and `ml` in environments where untrusted users can influence `MODULEPATH`. Additionally, ensure that shared module search paths do not include attacker-writable directories. As a practical measure, the affected completion script can be removed or disabled by commenting out its sourcing in shell configuration files (e.g., `~/.bashrc` or `/etc/profile.d/`). Users must start a new shell session for changes to take effect.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-78780 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-85013](https://cveledger.app/badge/CVE-2026-85013.svg)](https://cveledger.app/cve/CVE-2026-85013)

Record last updated 11 Nov 2026, 19:08 UTC.