CVE-2026-101032: navi through 2.24.0 OS Command Injection via Cheatsheet Variables
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
A victim must use navi with a cheatsheet variable that is substituted into a shell command and whose suggestions come from a directory containing an attacker-crafted file name. The victim must then interact with the suggestion so that the unescaped value is inserted into the command.
What level of access does an attacker need?
The attacker does not need privileges in navi itself, but must be able to place or cause a crafted filename to appear in a directory used by a suggestion command. Exploitation also requires user interaction.
What is the impact if exploitation succeeds?
Injected shell metacharacters can cause arbitrary commands to run with the privileges of the victim using navi. This can affect confidentiality, integrity, and availability of resources accessible to that user.