CVE-2026-85013

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

No known exploitation. EPSS puts it in the 12th percentile. Fixed versions are out.

CVSS 3.17.3High EPSS percentile12th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2 products4 fixed builds listed below

Published 2026-09-15Updated 2026-10-19Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Red Hat Enterprise Linux 10Fixed builds0:5.6.1-2.el10_2.1, 0:4.5.2-5.el8_10, 0:5.3.0-2.el9_8.1Stated by: CVE record
Red Hat Hardened ImagesFixed builds5.6.2-1.hum1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether Red Hat Enterprise Linux or Red Hat Hardened Images systems use Environment Modules and allow untrusted users to add files to locations searched for modules.
Until a fix is available, remove or restrict write access to module locations and review module names for shell characters such as ;, &, |, $, backticks, or parentheses.
No fixed version has been published; obtain the vendor update and install it when available.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

In plain language

Written by AI from the record

Environment Modules can let a malicious module name run commands in an employee’s account; small businesses using it should check their systems and restrict who can add modules.

CVE-2026-85013 is a CWE-78 command-injection flaw in Environment Modules Bash completion: shell metacharacters in a module name can be evaluated when completing `module` or `ml` commands.

If you're affected

Employee account takeover
Data theft or alteration
Service disruption
Malware installation

What is it

Environment Modules helps users switch between installed software tools. In this flaw, a hostile module name can act like a booby-trapped label: when someone uses command suggestions to find it, the label can make their computer carry out the attacker’s instructions.

Who is affected

This matters to you if you run Environment Modules on Red Hat Enterprise Linux or Red Hat Hardened Images. It is only a risk when an attacker can place a malicious module file in a location the user’s module search path can reach, and the user triggers Bash command completion.

How urgent is it

An attacker must place a malicious module name where a user can encounter it, then cause that user to use command completion. Treat this as an amber priority: tighten module-directory permissions now and schedule the vendor update once one is released.

What to do — in detail

Confirm whether Environment Modules is installed and identify every directory included in users’ MODULEPATH values. Review ownership and write permissions for those directories, especially shared storage and team-managed module repositories; only trusted administrators should be able to create or rename modulefiles there.

There is no published fixed version or supported upgrade path in the available findings. Keep vendor support channels under review for version-specific remediation information, then upgrade to the stated fixed release for each supported branch after testing normal module loading and shell-completion behavior.

If patching is delayed, disable Bash completion for module and ml where practical, remove suspicious module names, and prevent untrusted writes to all reachable module directories. Monitor file-creation and rename events in those directories, plus shell and endpoint alerts for unexpected commands launched by affected users. CISA has not added this CVE to KEV, so there is no CISA remediation due date.

Technical context

CVE-2026-85013 has CVSS 7.3 (High): CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. It is CWE-78 command injection with a local attack vector: a malicious modulefile name containing shell metacharacters is evaluated in the completing user’s shell through Bash completion for module or ml. It is not listed in CISA KEV, no public exploit code is on record, and EPSS is 0.2% (12th percentile) with a flat trend. Exploit maturity is therefore unproven publicly; successful exploitation still provides arbitrary command execution in the victim user’s context.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS12th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 12th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

17 events over 34 days, from the signal feeds we watch.

2026-10-19Workaround availablerecord updated
2026-10-14Workaround availablerecord updated
2026-10-12Workaround availablerecord updated
2026-09-21Workaround availablerecord updated
2026-09-17OpenVAS check added
2026-09-16Workaround availablerecord updated

Affected products

Red Hatcommercial · US
- Red Hat Enterprise Linux 10OSOn-premOperating Systems / linux-distro
- Red Hat Hardened ImagesOSOn-premOperating Systems / linux-distro

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Scored 7.3 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable