CVE-2026-6842
Low · 2.5CVSS
2.5
EPSS
0.1%
Published
Apr 22, 2026
CISA due date
—
The record
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | nano | 0 | 9.1-bp160.1.1 |
| openSUSE:Tumbleweed | nano | 0 | 9.0-2.1 |
Related vulnerabilities
- CVE-2026-40556 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering… Also affects nano
- CVE-2026-6843 A flaw was found in nano. Also affects nano
- CVE-2024-5742 A vulnerability was found in GNU Nano that allows a possible privilege escalation through… Also affects nano
- CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-732
- CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code… CWE-732
- CVE-2026-87988 An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass… CWE-732
- CVE-2026-19583 Velociraptor allows some sensitive artifacts to be gated by additional permissions. CWE-732
- CVE-2026-79617 Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM… CWE-732