CVE-2026-85013 Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

Description

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Exploitable with local access to the machine, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Local

Attack complexity

Low

Privileges required

Low

Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products and versions