CVE-2026-40556

GNU nano creates the user’s ~/.local directory with overly permissive permissions when the directory does not exist yet. On first use of features requiring Cross-Desktop Group (XDG) data storage, nano explicitly requests directory mode 0777, making the directory world‑writable in environments where the process umask does not sufficiently restrict permissions. In systems with a relaxed or zero umask, such as container environments, CI/CD runners, embedded systems, or user shells configured with umask 000, this results in ~/.local being created as world‑writable. A local attacker can exploit a race window between nano’s creation of ~/.local and its subsequent creation of more restrictive subdirectories to write attacker‑controlled files into the victim’s XDG directory hierarchy.

This problem was fixed in nano version 9.0

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

These are all security issues fixed in the nano-9.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nano fixes the following issues:

Changes in nano:

• Update to version 9.1:

  • When searching, the viewport is placed snug left where possible.
  • The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed.
  • The ^T toggle between WhereIs and GotoLine was dropped.
  • Fix backups that were missing or had a wrong timestamp when --backup is active.
  • On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner.
  • The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream).
  • M-Ins and M-Del have become rebindable.

• GNU nano 9.0:

  • When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling.
  • The viewport can be scrolled sideways (in steps of one tabsize) with M-< and M->. See man nanorc if M-< and M-> should switch between buffers (as they did earlier).
  • M-Left, M-Right, M-Up, and M-Down have become rebindable.
  • Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place.
  • Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle.
  • With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer.
  • CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643)
  • create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)

• GNU nano 8.7.1:

  • fix build against glibc-2.43 (boo#1258260)

• GNU nano 8.7:

  • At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc

(GNU nano creates the user\u2019s ~/.local directory with overly permis ...)