CVE-2026-6842

Nano is a tiny GNU editor

Security Fix(es):

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the ~/.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.(CVE-2026-6842)

A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline() function. By creating a directory with a name containing printf specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the nano application.(CVE-2026-6843)

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the ~/.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the ~/.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

Local attacker can inject malicious .desktop launcher due to insecure directory permissions. (CVE-2026-6842) Format string vulnerability leads to denial of service. (CVE-2026-6843)

These are all security issues fixed in the nano-9.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for nano fixes the following issues:

Changes in nano:

• Update to version 9.1:

  • When searching, the viewport is placed snug left where possible.
  • The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed.
  • The ^T toggle between WhereIs and GotoLine was dropped.
  • Fix backups that were missing or had a wrong timestamp when --backup is active.
  • On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner.
  • The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream).
  • M-Ins and M-Del have become rebindable.

• GNU nano 9.0:

  • When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling.
  • The viewport can be scrolled sideways (in steps of one tabsize) with M-< and M->. See man nanorc if M-< and M-> should switch between buffers (as they did earlier).
  • M-Left, M-Right, M-Up, and M-Down have become rebindable.
  • Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place.
  • Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle.
  • With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer.
  • CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643)
  • create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)

• GNU nano 8.7.1:

  • fix build against glibc-2.43 (boo#1258260)

• GNU nano 8.7:

  • At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc

Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created the ~/.local directory with incorrect permissions. In environments with permissive umask settings, a local attacker could possibly use this issue to inject a malicious launcher file, resulting in information disclosure or other unintended actions. (CVE-2026-6842)

Michał Majchrowicz and Marcin Wyczechowski discovered that Nano incorrectly handled directory names when updating the status line. A local attacker could possibly use this issue to cause Nano to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-6843)