CVE-2026-6842: Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6842?
CVE-2026-6842 is classified as a high-severity vulnerability due to its potential exploitation by local attackers.
How do I fix CVE-2026-6842?
To mitigate CVE-2026-6842, correct the directory permissions of the ~/.local directory to 0700.
Who is affected by CVE-2026-6842?
CVE-2026-6842 affects users of GNU Nano with permissive umask settings that lead to insecure directory permissions.
What type of vulnerability is CVE-2026-6842?
CVE-2026-6842 is a local privilege escalation vulnerability that allows attackers to inject malicious .desktop launcher files.
Can CVE-2026-6842 be exploited remotely?
No, CVE-2026-6842 can only be exploited by local attackers with access to the system.