CVE-2026-6842: Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the ~/.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
Other sources
nano creates ~/.local with mode 0777 instead of 0700. In permissive-umask environments (containers, CI), local attacker can race to inject malicious .desktop launcher. The subsequent mkdir for ~/.local/share correctly uses 0700.
Affected: src/history.c lines 229-234. BZ#2455314. Reported by Michał Majchrowicz and Marcin Wyczechowski, AFINE Team.
— Red Hat
Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nanoto a version that resolves this vulnerability.Fixed in 8.4-1+deb13u1Fixed in 9.0-1 - Upgrade
Upgrade
nanoto a version that resolves this vulnerability.Patch BZ#2455314
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6842?
CVE-2026-6842 is classified as a high-severity vulnerability due to its potential exploitation by local attackers.
How do I fix CVE-2026-6842?
To mitigate CVE-2026-6842, correct the directory permissions of the ~/.local directory to 0700.
Who is affected by CVE-2026-6842?
CVE-2026-6842 affects users of GNU Nano with permissive umask settings that lead to insecure directory permissions.
What type of vulnerability is CVE-2026-6842?
CVE-2026-6842 is a local privilege escalation vulnerability that allows attackers to inject malicious .desktop launcher files.
Can CVE-2026-6842 be exploited remotely?
No, CVE-2026-6842 can only be exploited by local attackers with access to the system.