CVE-2026-85013

environment-modules contains a local OS command injection flaw (CWE-78) in the Bash completion logic for the 'module' and 'ml' commands. An attacker with write access to a directory on the victim's MODULEPATH can plant a maliciously named modulefile whose filename embeds shell metacharacters; when the victim presses Tab to complete a module command, the name is evaluated by the shell and the injected commands run with the victim's privileges, compromising that account's confidentiality, integrity, and availability (CVSS 7.3, local vector, low privileges, user interaction required). The issue primarily affects shared multi-user systems such as HPC and research computing clusters where untrusted users can write to module directories. No public proof of concept is known and no exploitation in the wild has been reported; the flaw is not listed in CISA's KEV catalog.

What to do: Apply a fixed environment-modules package from your distribution or upstream as soon as one is released, prioritizing shared multi-user systems. In the interim, audit all MODULEPATH directories for modulefiles whose names contain shell metacharacters and remove or rename them, and restrict write permissions on those directories to trusted administrators only. Also check site bash completion definitions for module/ml to confirm module names are properly quoted before evaluation.