Description

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T16:17:34.543Z",
  "pubdate": "2026-09-15T16:17:34.543Z",
  "executiveSummary": "A command injection vulnerability has been identified in environment-modules, triggered during the Bash completion process for 'module' or 'ml' commands.\nThe vulnerability allows a local attacker to execute arbitrary commands with the privileges of the user invoking the completion functionality.\nThe flaw resides in the unsafe evaluation of module filenames that contain shell metacharacters when they are present within the system's MODULEPATH.\nSuccessful exploitation requires the attacker to place a maliciously crafted modulefile in a location accessible to the victim's search path.\nThe impact is significant, as it compromises the confidentiality, integrity, and availability of the user's environment.\nSince the execution occurs within the context of the user's shell during completion, the attacker can gain full access to the user's data, persistent shell configurations, and environment variables.\nThis vulnerability is strictly local, requiring the attacker to have at least minimal filesystem access to create files that the victim's environment will parse.",
  "technicalDetails": "The vulnerability originates from insufficient input sanitization within the Bash completion scripts utilized by environment-modules.\nWhen a user triggers Bash completion for the 'module' or 'ml' commands, the shell attempts to iterate through directories defined in the MODULEPATH environment variable to suggest available module files.\nThe completion logic improperly handles filenames that contain shell metacharacters, such as backticks, semicolons, or dollar signs, during the retrieval and presentation of these filenames.\nAn attacker can exploit this by creating a file with a malicious name in a directory that is included in the target user's MODULEPATH. For instance, creating a file named '$(touch /tmp/pwned)' or similar variants allows for arbitrary command execution.\nWhen the victim presses the tab key to trigger completion, the shell script inadvertently evaluates the malicious filename string as a command rather than treating it as a literal string.\nThe attack flow follows these steps: First, the attacker identifies a directory accessible to the victim that is part of the MODULEPATH. Second, the attacker places a file with a name containing shell injection payloads into that directory. Third, the victim performs a 'module load' or 'ml' command and triggers Bash completion. Fourth, the shell completion process executes the malicious payload embedded in the filename.\nThe execution happens in the user's current shell process, meaning any commands executed by the payload run with the full privileges of the user initiating the completion. This grants the attacker a foothold to escalate activity, steal sensitive credentials, or modify the user's environment for persistence.\nThe flaw affects the interaction between the environment-modules completion logic and the Bash shell's command substitution mechanisms. Because the completion function relies on evaluation rather than static string processing, it remains vulnerable to any input that can be interpreted by the shell interpreter during the suggestion generation phase."
}