CVE catalog

CVE-2026-6842

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows

[CVE catalog]

Severity
Low · CVSS 2.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.08% · Oct 25, 2026

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannanosid9.3-1fixed
Debiannanoforky9.2-1fixed
Debiannanotrixie8.4-1+deb13u1fixed
Debiannanobookworm7.2-1+deb12u1vulnerable
CpenanoNot reported7.2-2ubuntu0.2fixed
Cpenano-tinyNot reported7.2-2ubuntu0.2fixed
CpenanoNot reportedNot reportedvulnerable
Opensusenanoleap 16.09.1-bp160.1.1fixed
Ubuntunanopro4.3-1vulnerable
Ubuntunanopro4.5-1vulnerable
Ubuntunanopro4.7-1vulnerable
Ubuntunanopro4.7-2vulnerable
Ubuntunanopro4.8-1vulnerable
Ubuntunanopro4.8-1ubuntu1vulnerable
Ubuntunanopro4.8-1ubuntu1.1vulnerable
Ubuntunanopro4.8-1ubuntu1.1+esm1fixed
Ubuntunano22.045.6.1-1build1vulnerable
Ubuntunano22.045.9-1vulnerable
Ubuntunano22.046.0-1vulnerable
Ubuntunano22.046.1-1vulnerable
Ubuntunano22.046.2-1vulnerable
Ubuntunano22.046.2-1ubuntu0.1vulnerable
Ubuntunano22.046.2-1ubuntu0.2fixed
Ubuntunano24.047.2-1vulnerable
Ubuntunano24.047.2-2vulnerable
Ubuntunano24.047.2-2build1vulnerable
Ubuntunano24.047.2-2ubuntu0.1vulnerable
Ubuntunano24.047.2-2ubuntu0.2fixed
Ubuntunano25.108.3-1vulnerable
Ubuntunano25.108.4-1vulnerable
Ubuntunano25.108.4-1ubuntu0.1fixed
Ubuntunano26.048.4-1vulnerable
Ubuntunano26.048.6-1vulnerable
Ubuntunano26.048.7-1vulnerable
Ubuntunano26.048.7.1-1vulnerable
Ubuntunano26.048.7.1-1ubuntu0.1fixed
Ubuntunanopro4.3-1vulnerable
Ubuntunanopro4.5-1vulnerable
Ubuntunanopro4.7-1vulnerable
Ubuntunanopro4.7-2vulnerable
Ubuntunanopro4.8-1vulnerable
Ubuntunanopro4.8-1ubuntu1vulnerable
Ubuntunanopro4.8-1ubuntu1.1vulnerable
Ubuntunanopro4.8-1ubuntu1.1+esm1fixed
Ubuntunano22.045.6.1-1build1vulnerable
Ubuntunano22.045.9-1vulnerable
Ubuntunano22.046.0-1vulnerable
Ubuntunano22.046.1-1vulnerable
Ubuntunano22.046.2-1vulnerable
Ubuntunano22.046.2-1ubuntu0.1vulnerable
Ubuntunano22.046.2-1ubuntu0.2fixed
Ubuntunano24.047.2-1vulnerable
Ubuntunano24.047.2-2vulnerable
Ubuntunano24.047.2-2build1vulnerable
Ubuntunano24.047.2-2ubuntu0.1vulnerable
Ubuntunano24.047.2-2ubuntu0.2fixed
Ubuntunano25.108.3-1vulnerable
Ubuntunano25.108.4-1vulnerable
Ubuntunano25.108.4-1ubuntu0.1fixed
Ubuntunano26.048.4-1vulnerable
Ubuntunano26.048.6-1vulnerable
Ubuntunano26.048.7-1vulnerable
Ubuntunano26.048.7.1-1vulnerable
Ubuntunano26.048.7.1-1ubuntu0.1fixed
Opensusenanotumbleweed9.0-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannanosourcesid9.0-1not yet assignedNot reportedNot reported
Debiannanosourceforky9.0-1not yet assignedNot reportedNot reported
Debiannanosourcetrixie8.4-1+deb13u1not yet assignedNot reportedNot reported
Debiannanosourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpenanocpeNot reported7.2-2ubuntu0.2Not reportedNot reportedNot reported
Cpenano-tinycpeNot reported7.2-2ubuntu0.2Not reportedNot reportedNot reported
Opensusenanorpmleap 16.09.1-bp160.1.1Not reportedOPENSUSE-SU-2026:21166-1Not reported
Ubuntunanodebpro4.8-1ubuntu1.1+esm1Not reportedUSN-8386-1Not reported
Ubuntunanodeb22.046.2-1ubuntu0.2Not reportedUSN-8386-1Not reported
Ubuntunanodeb24.047.2-2ubuntu0.2Not reportedUSN-8386-1Not reported
Ubuntunanodeb25.108.4-1ubuntu0.1Not reportedUSN-8386-1Not reported
Ubuntunanodeb26.048.7.1-1ubuntu0.1Not reportedUSN-8386-1Not reported
Ubuntunanodebpro4.8-1ubuntu1.1+esm1Not reportedUBUNTU-CVE-2026-6842Not reported
Ubuntunanodeb22.046.2-1ubuntu0.2Not reportedUBUNTU-CVE-2026-6842Not reported
Ubuntunanodeb24.047.2-2ubuntu0.2Not reportedUBUNTU-CVE-2026-6842Not reported
Ubuntunanodeb25.108.4-1ubuntu0.1Not reportedUBUNTU-CVE-2026-6842Not reported
Ubuntunanodeb26.048.7.1-1ubuntu0.1Not reportedUBUNTU-CVE-2026-6842Not reported
Opensusenanorpmtumbleweed9.0-2.1Not reportedOPENSUSE-SU-2026:10851-1Not reported

Notes

[bookworm] nano: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [nano]Affected
    Details (2)

    • 7.2-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · nano · debian · bookworm; nvd · nano · debian · 12

    • 7.2-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · nano · debian · bookworm; nvd · nano · debian · 12

  • [nano-tiny]Affected

    Source package: [nano]

    Details (2)

    • 7.2-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · nano · debian · bookworm; nvd · nano · debian · 12

    • 7.2-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · nano · debian · bookworm; nvd · nano · debian · 12

[openSUSE Tumbleweed]

  • [nano-lang]Unknown

    Source package: [nano]

    Details (1)

    • 9.2-1.1 · noarch · tumbleweed

      Unknown · Fixed: 9.0-2.1

      Version impact unknown

      nvd · nano · opensuse · tumbleweed

  • [nano]Fixed

    Source package: [nano]

    Details (1)

    • 9.2-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 9.0-2.1

      nvd · nano · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [nano]Fixed
    Details (2)

    • 8.4-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 8.4-1+deb13u1

      nvd · nano · debian · 13

    • 8.4-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 8.4-1+deb13u1

      nvd · nano · debian · 13

  • [nano-tiny]Fixed

    Source package: [nano]

    Details (2)

    • 8.4-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 8.4-1+deb13u1

      nvd · nano · debian · 13

    • 8.4-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 8.4-1+deb13u1

      nvd · nano · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]