Command Injection Vulnerability in Environment-Modules Package
Summary
RLSA-2026:82919: Moderate: environment-modules security update. Affects environment-modules versions < 0:4.5.2-5.el8_10. Fixed in 0:4.5.2-5.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The environment-modules package is a tool that allows dynamic modification of a user's environment through the use of module files. These files contain the necessary information to configure the shell for various applications, enabling users to load and unload application environments seamlessly. However, this package has been found to be vulnerable to command injection attacks due to improper handling of module names containing shell metacharacters.
Vulnerability Detail
The vulnerability, identified as CVE-2026-85013, arises from the environment-modules package's Bash completion feature. Specifically, it allows for command injection via malicious module names that include shell metacharacters. This could potentially allow an attacker to execute arbitrary commands in the context of the user running the module utility, leading to unauthorized access or manipulation of the system. The CVSS score for this vulnerability is 7.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:4.5.2-5.el8_10
This is the first release that contains the fix.
sudo dnf update environment-modulesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using module names that contain shell metacharacters until the package can be updated. This can help mitigate the risk of command injection attacks.
Conclusion
The environment-modules package has a moderate severity vulnerability (CVE-2026-85013) that allows for command injection through malicious module names. It is crucial to update to the patched version to mitigate this risk. Users should also be cautious with module names until the update is applied.
See every vulnerability recorded for environment-modules →
FAQ
The environment-modules package is a utility that allows users to dynamically modify their shell environment using module files, which configure the environment for various applications.
CVE-2026-85013 is the identifier for a security vulnerability in the environment-modules package that allows for command injection through malicious module names.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, avoid using module names with shell metacharacters as a temporary workaround to reduce the risk of exploitation.
Shell metacharacters are special characters in shell scripting that have a specific meaning, such as '&', '|', ';', and '$', which can be used to manipulate command execution.
Related vulnerabilities
Recent vulnerabilities recorded for environment-modules.
