CVE-2026-101032

7.0 Élevée

Publiée le 27/09/2026 à 16:16 · Modifiée le 30/09/2026 à 19:32 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

Traduire en français

Produits concernés

denisidoro navi

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.3 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	7.0 Élevée	disclosure@vulncheck.com	`CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/denisidoro/navi
https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/commands/core/actor.rs#L159-L193
https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/common/shell.rs#L39-L50
https://github.com/denisidoro/navi/issues/1037
https://www.vulncheck.com/advisories/navi-through-2.24.0-os-command-injection-via-cheatsheet-variables

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories