Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-85013: _module_comgen_words_and_files() fed untrusted text (module names read off disk, LOADEDMODULES, MODULEPATH) straight into `compgen -W`, which performs a full unquoted-word expansion on its wordlist -- including command substitution -- as a normal, documented part of its behavior. A module name, loaded-module entry, or MODULEPATH component containing e.g. `$(...)` therefore ran arbitrary shell code the moment a user pressed Tab.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | environment-modules | 0:4.8.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | environment-modules-compat | 0:4.8.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | environment-modules-compat-debuginfo | 0:4.8.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | environment-modules-debuginfo | 0:4.8.0-1.amzn2023.0.3 |
| Amazon Linux · 2023 | environment-modules-debugsource | 0:4.8.0-1.amzn2023.0.3 |
Vulnerabilities 1
-
High 7.3
Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the mali…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-85013.html