{"id":"CVE-2026-6842","aliases":["AZL-85557","DEBIAN-CVE-2026-6842","EUVD-2026-24633","GHSA-ccfr-97mr-qq8g","MGASA-2026-0121","OESA-2026-2160","UBUNTU-CVE-2026-6842","USN-8386-1","openSUSE-SU-2026:10851-1","openSUSE-SU-2026:21166-1"],"status":"published","title":"Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","severity":{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00085,"percentile":0.00278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2026-04-22T07:34:26Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"nano","fixed_in":["6.4-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nano","fixed_in":["8.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nano","fixed_in":["9.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","fixed_in":["2.9.3-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nano","fixed_in":["4.8-1ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nano","fixed_in":["6.2-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nano","fixed_in":["7.2-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nano","fixed_in":["8.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nano","fixed_in":["8.7.1-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2-1","7.2-1+deb12u1","7.2-2","8.0-1","8.1-1","8.2-1","8.3-1","8.4-1","8.5-1","8.6-1","8.7-1","8.7.1-1","9.0-1","9.1-1","9.2-1","9.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1+deb13u1"}]}],"versions":["8.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-1"}]}],"versions":["8.4-1","8.5-1","8.6-1","8.7-1","8.7.1-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-1.2.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-2.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-2.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-2ubuntu0.1~esm2"}]}],"versions":["2.8.6-3","2.8.7-1","2.9.0-1","2.9.1-1","2.9.2-1","2.9.3-1","2.9.3-2","2.9.3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1ubuntu1.1+esm1"}]}],"versions":["4.3-1","4.5-1","4.7-1","4.7-2","4.8-1","4.8-1ubuntu1","4.8-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.2"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1","6.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.2"}]}],"versions":["7.2-1","7.2-2","7.2-2build1","7.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1ubuntu0.1"}]}],"versions":["8.3-1","8.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1ubuntu0.1"}]}],"versions":["8.4-1","8.6-1","8.7-1","8.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-2ubuntu0.1~esm2"}]}],"versions":["2.8.6-3","2.8.7-1","2.9.0-1","2.9.1-1","2.9.2-1","2.9.3-1","2.9.3-2","2.9.3-2ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1ubuntu1.1+esm1"}]}],"versions":["4.3-1","4.5-1","4.7-1","4.7-2","4.8-1","4.8-1ubuntu1","4.8-1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.2"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1","6.2-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.2"}]}],"versions":["7.2-1","7.2-2","7.2-2build1","7.2-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-1ubuntu0.1"}]}],"versions":["8.3-1","8.4-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.7.1-1ubuntu0.1"}]}],"versions":["8.4-1","8.6-1","8.7-1","8.7.1-1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-6842","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460018","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6842","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ccfr-97mr-qq8g"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6842.json","tags":["advisory"]},{"url":"https://git.savannah.gnu.org/git/nano.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6842","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0121.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35466","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLLMINU5CKQDNMS5OT7OKS5V6YQFIJUC/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6843","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6842","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455314","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8386-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-6843","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6843","tags":["web"]},{"url":"https://bugzilla.suse.com/1258260","tags":["report"]},{"url":"https://bugzilla.suse.com/1262643","tags":["report"]},{"url":"https://bugzilla.suse.com/1263022","tags":["report"]},{"url":"https://bugzilla.suse.com/1263437","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40556","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-6842","title":"Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T07:34:26.36Z","modified":"2026-11-06T19:36:53.062Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-06T20:30:05.028126Z"}],"euvd":[{"id":"EUVD-2026-24633","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T07:34:26Z","modified":"2026-11-06T19:36:53Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T21:07:00.781791Z"}],"ghsa":[{"id":"GHSA-ccfr-97mr-qq8g","title":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can...","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T09:31:31Z","modified":"2026-04-22T09:31:39Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:07:34.1405Z"}],"nvd":[{"id":"CVE-2026-6842","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T08:16:13.17Z","modified":"2026-11-06T20:17:24.887Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-06T22:02:11.743368Z"}],"osv":[{"id":"CVE-2026-6842","title":"Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T07:34:26.36Z","modified":"2026-11-10T02:30:16.986651234Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-732"],"updated_at":"2026-11-07T11:15:41.683306Z"},{"id":"DEBIAN-CVE-2026-6842","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T08:16:13.17Z","modified":"2026-11-07T09:47:35.643543434Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-2160","title":"nano security update","description":"Nano is a tiny GNU editor\r\n\r\nSecurity Fix(es):\n\nA flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.(CVE-2026-6842)\n\nA flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.(CVE-2026-6843)","status":"published","published":"2026-05-03T11:11:08Z","modified":"2026-08-18T01:19:50.96605289Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2026-6842","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T08:16:00Z","modified":"2026-06-05T03:03:06.73338911Z","cvss":[{"version":"3.1","score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"AZL-85557","title":"CVE-2026-6842 affecting package nano for versions less than 6.4-3","description":"A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.","status":"published","published":"2026-04-22T08:16:13Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.190302Z"},{"id":"MGASA-2026-0121","title":"Updated nano packages fix security vulnerabilities","description":"Local attacker can inject malicious .desktop launcher due to insecure\ndirectory permissions. (CVE-2026-6842)\nFormat string vulnerability leads to denial of service. (CVE-2026-6843)\n","status":"published","published":"2026-05-07T05:06:13Z","modified":"2026-05-07T05:15:21.424775Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10851-1","title":"nano-9.0-2.1 on GA media","description":"These are all security issues fixed in the nano-9.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:05.344180104Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21166-1","title":"Security update for nano","description":"This update for nano fixes the following issues:\n\nChanges in nano:\n\n- Update to version 9.1:\n  * When searching, the viewport is placed snug left where\n    possible.\n  * The ability to read and write files in old Mac format (a lone\n    carriage return as line ending) was removed.\n  * The ^T toggle between WhereIs and GotoLine was dropped.\n  * Fix backups that were missing or had a wrong timestamp when\n    --backup is active.\n  * On a crash or kill, a .save file is no longer chmodded or\n    chowned to the base file's permissions and owner.\n  * The history code now creates the ~/.local directory with\n    limited access rights (boo#1263437; the referenced\n    CVE-2026-40556 was rejected upstream).\n  * M-Ins and M-Del have become rebindable.\n\n- GNU nano 9.0:\n  * When the cursor almost goes offscreen to the right, all lines\n    are now scrolled sideways together, by just the amount needed\n    to keep the cursor in view.\n    Use --solosidescroll or 'set solosidescroll' to get back the\n    old, jerky, single-line horizontal scrolling.\n  * The viewport can be scrolled sideways (in steps of one\n    tabsize) with M-\u003c and M-\u003e.  See `man nanorc` if M-\u003c and M-\u003e\n    should switch between buffers (as they did earlier).\n  * M-Left, M-Right, M-Up, and M-Down have become rebindable.\n  * Stopping the recording of a macro immediately after starting\n    it cancels the recording and leaves an existing macro in place.\n  * Feature toggles no longer break a chain of ^K cuts or M-6\n    copies, except the M-K cut-from-cursor toggle.\n  * With --mouse and --indicator, one can click in the scrollbar\n    area to roughly navigate within the buffer.\n  * CVE-2026-6843: format string vulnerability leads to denial of\n    service (boo#1262643)\n  * create the ~/.local directory with limited access rights\n    (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)\n\n- GNU nano 8.7.1:\n  * fix build against glibc-2.43 (boo#1258260)\n\n- GNU nano 8.7:\n  * At the Execute prompt, preceding the command with two pipe\n    symbols allows implementing a copy-to-clipboard feature in\n    nanorc on terminals that support OSC 52. See doc/sample.nanorc\n","status":"published","published":"2026-06-29T08:14:36Z","modified":"2026-06-30T09:15:07.746855861Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"USN-8386-1","title":"nano vulnerabilities","description":"Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created\nthe ~/.local directory with incorrect permissions. In environments with\npermissive umask settings, a local attacker could possibly use this\nissue to inject a malicious launcher file, resulting in information\ndisclosure or other unintended actions. (CVE-2026-6842)\n\nMichał Majchrowicz and Marcin Wyczechowski discovered that Nano\nincorrectly handled directory names when updating the status line. A\nlocal attacker could possibly use this issue to cause Nano to crash,\nresulting in a denial of service. This issue only affected Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.\n(CVE-2026-6843)","status":"published","published":"2026-06-04T17:00:06Z","modified":"2026-06-05T03:14:22.429951264Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}