High · CVSS 7.3CVE-2026-85013

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharactersCVE-2026-85013

Answer in brief

CVE-2026-85013 records a High severity (CVSS 7.3) vulnerability in Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters. The current sources do not mark it as known exploited. The current feed maps Red Hat/environment-modules (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Oct 19, 2026Source checked Oct 31, 2026First seen by HOL Sep 15, 2026Material review Oct 19, 2026

Upstream Advisory

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Red Hat/environment-modulesgeneric	*	Not reported

Package

Affected range

Fixed version

Red Hat/environment-modulesgeneric

Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Red Hat/environment-modules.

Review the reported fix. Source-reported workaround: To mitigate this issue, avoid enabling Bash completion for `module` and `ml` in environments where untrusted users can influence `MODULEPATH`. Additionally, ensure that shared module search paths do not include attacker-writable directories. As a practical measure, the affected completion script can be removed or disabled by commenting out its sourcing in shell configuration files (e.g., `~/.bashrc` or `/etc/profile.d/`). Users must start a new shell session for changes to take effect.

Sources and claim methodology

Upstream source description

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Quoted source text, attributed separately from HOL analysis.

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharactersCVE-2026-85013

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharactersCVE-2026-85013

Key facts

Why this deserves its current priority

Affected scope and exposure questions

Recommended response

Evidence timeline and material changes

Sources and claim methodology