CyberRota Analysis
AI-GeneratedA vulnerability exists in environment-modules that allows a local attacker to exploit Bash completion by placing a maliciously named modulefile within the victim's `MODULEPATH`. This can result in arbitrary command execution in the user's shell, compromising confidentiality, integrity, and availability. Organizations using environment-modules should prioritize addressing this issue to protect against potential local attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.