CVE-2026-85013

Name of the Vulnerable Software and Affected Versions environment-modules versions 3.2.7 through 5.6.1

Description A local attacker can exploit a flaw by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, which contains shell metacharacters, is evaluated as a command. This results in arbitrary command execution within the user's shell, compromising confidentiality, integrity, and availability.

Recommendations Update environment-modules to version 5.6.2, 5.3.2, or 4.5.4.