Bug 2460018 (CVE-2026-6842)

Summary: CVE-2026-6842 nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2460502    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-21 08:47:02 UTC 
nano creates ~/.local with mode 0777 instead of 0700. In permissive-umask environments (containers, CI), local attacker can race to inject malicious .desktop launcher. The subsequent mkdir for ~/.local/share correctly uses 0700.

Affected: src/history.c lines 229-234. BZ#2455314.
Reported by Michał Majchrowicz and Marcin Wyczechowski, AFINE Team.