Summary
Michał Majchrowicz and Marcin Wyczechowski discovered that Nano created
the ~/.local directory with incorrect permissions. In environments with
permissive umask settings, a local attacker could possibly use this
issue to inject a malicious launcher file, resulting in information
disclosure or other unintended actions. (CVE-2026-6842)
Michał Majchrowicz and Marcin Wyczechowski discovered that Nano
incorrectly handled directory names when updating the status line. A
local attacker could possibly use this issue to cause Nano to crash,
resulting in a denial of service. This issue only affected Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS.
(CVE-2026-6843)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | nano | 6.2-1ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | nano | 7.2-2ubuntu0.2 |
| Ubuntu · 25.10 | nano | 8.4-1ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | nano | 8.7.1-1ubuntu0.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nano | 2.9.3-2ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | nano | 4.8-1ubuntu1.1+esm1 |
Vulnerabilities 2
-
Medium 5.5
Nano: nano: format string vulnerability leads to denial of service
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fau…
-
Low 2.5
Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, whi…