CyberRota Analysis
AI-GeneratedThe vulnerability in navi versions prior to 2.24.0 allows attackers to inject shell metacharacters via crafted file names, leading to the execution of arbitrary commands with the privileges of the victim. This poses a significant risk to users who utilize navi for command suggestions, as it can result in unauthorized access and control over the system. Organizations using this software should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.