← voltar
CVE-2026-6842lowCWE-732

Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.5epss 0.1%
probabilidade de exploração
0.1%top 100% das CVEs
exploração observada
nãonenhuma fonte reporta
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N