{"id":"CVE-2026-40556","aliases":["DEBIAN-CVE-2026-40556","EUVD-2026-26053","GHSA-9g7j-rcqf-cpcx","UBUNTU-CVE-2026-40556","openSUSE-SU-2026:11120-1","openSUSE-SU-2026:21166-1"],"status":"rejected","title":"GNU nano creates the user’s ~/.local directory with overly permissive permissions when the...","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2026-04-28T13:54:11Z","modified":"2026-10-16T14:10:00Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"nano","fixed_in":["9.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-bp160.1.1"}]}],"bundled":3}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40556"},{"url":"https://cert.pl/en/posts/2026/04/CVE-2026-40556"},{"url":"https://cgit.git.savannah.gnu.org/cgit/nano.git/commit/?id=cb43493e"},{"url":"https://www.nano-editor.org"},{"url":"https://github.com/advisories/GHSA-9g7j-rcqf-cpcx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40556","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40556","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40556","tags":["web"]},{"url":"https://bugzilla.suse.com/1258260","tags":["report"]},{"url":"https://bugzilla.suse.com/1262643","tags":["report"]},{"url":"https://bugzilla.suse.com/1263022","tags":["report"]},{"url":"https://bugzilla.suse.com/1263437","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6843","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-40556","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"rejected","published":"2026-04-28T13:54:11.918Z","modified":"2026-04-29T07:17:27.349Z","updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-26053","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"published","published":"2026-04-28T13:54:11Z","modified":"2026-04-29T07:17:27Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T19:05:23.176094Z"}],"ghsa":[{"id":"GHSA-9g7j-rcqf-cpcx","title":"GNU nano creates the user’s ~/.local directory with overly permissive permissions when the...","description":"GNU nano creates the user’s ~/.local directory with overly permissive permissions when the directory does not exist yet. On first use of features requiring Cross-Desktop Group (XDG) data storage, nano explicitly requests directory mode 0777, making the directory world‑writable in environments where the process umask does not sufficiently restrict permissions.\nIn systems with a relaxed or zero umask, such as container environments, CI/CD runners, embedded systems, or user shells configured with umask 000, this results in ~/.local being created as world‑writable. A local attacker can exploit a race window between nano’s creation of ~/.local and its subsequent creation of more restrictive subdirectories to write attacker‑controlled files into the victim’s XDG directory hierarchy.\n\nThis problem was fixed in nano version 9.0","status":"published","published":"2026-04-28T15:30:51Z","modified":"2026-04-28T15:30:58Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:07:41.244447Z"}],"nvd":[{"id":"CVE-2026-40556","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"rejected","published":"2026-04-28T15:16:30.15Z","modified":"2026-10-16T14:10:00.12Z","updated_at":"2026-11-02T14:12:16.252509Z"}],"osv":[{"id":"DEBIAN-CVE-2026-40556","status":"withdrawn","published":"2026-04-28T15:16:30.15Z","modified":"2026-04-30T14:00:41.114185Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"openSUSE-SU-2026:11120-1","title":"nano-9.1-1.1 on GA media","description":"These are all security issues fixed in the nano-9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:09.083260862Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21166-1","title":"Security update for nano","description":"This update for nano fixes the following issues:\n\nChanges in nano:\n\n- Update to version 9.1:\n  * When searching, the viewport is placed snug left where\n    possible.\n  * The ability to read and write files in old Mac format (a lone\n    carriage return as line ending) was removed.\n  * The ^T toggle between WhereIs and GotoLine was dropped.\n  * Fix backups that were missing or had a wrong timestamp when\n    --backup is active.\n  * On a crash or kill, a .save file is no longer chmodded or\n    chowned to the base file's permissions and owner.\n  * The history code now creates the ~/.local directory with\n    limited access rights (boo#1263437; the referenced\n    CVE-2026-40556 was rejected upstream).\n  * M-Ins and M-Del have become rebindable.\n\n- GNU nano 9.0:\n  * When the cursor almost goes offscreen to the right, all lines\n    are now scrolled sideways together, by just the amount needed\n    to keep the cursor in view.\n    Use --solosidescroll or 'set solosidescroll' to get back the\n    old, jerky, single-line horizontal scrolling.\n  * The viewport can be scrolled sideways (in steps of one\n    tabsize) with M-\u003c and M-\u003e.  See `man nanorc` if M-\u003c and M-\u003e\n    should switch between buffers (as they did earlier).\n  * M-Left, M-Right, M-Up, and M-Down have become rebindable.\n  * Stopping the recording of a macro immediately after starting\n    it cancels the recording and leaves an existing macro in place.\n  * Feature toggles no longer break a chain of ^K cuts or M-6\n    copies, except the M-K cut-from-cursor toggle.\n  * With --mouse and --indicator, one can click in the scrollbar\n    area to roughly navigate within the buffer.\n  * CVE-2026-6843: format string vulnerability leads to denial of\n    service (boo#1262643)\n  * create the ~/.local directory with limited access rights\n    (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)\n\n- GNU nano 8.7.1:\n  * fix build against glibc-2.43 (boo#1258260)\n\n- GNU nano 8.7:\n  * At the Execute prompt, preceding the command with two pipe\n    symbols allows implementing a copy-to-clipboard feature in\n    nanorc on terminals that support OSC 52. See doc/sample.nanorc\n","status":"published","published":"2026-06-29T08:14:36Z","modified":"2026-06-30T09:15:07.746855861Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"UBUNTU-CVE-2026-40556","description":"(GNU nano creates the user\\u2019s ~/.local directory with overly permis ...)","status":"withdrawn","published":"2026-04-29T00:00:00Z","modified":"2026-05-14T14:42:59.233826Z","updated_at":"2026-11-02T16:56:16.686388Z"}]}}