CVE-2026-85013: Environment-Modules RCE Vulnerability

CVE-2026-85013 Overview

CVE-2026-85013 is a command injection vulnerability [CWE-78] in environment-modules, a tool used to dynamically modify a user's shell environment through modulefiles. A local attacker can place a maliciously named modulefile in a directory referenced by the victim's MODULEPATH. When the victim invokes Bash completion for the module or ml commands, the shell evaluates the malicious module name containing shell metacharacters as a command. The result is arbitrary command execution in the victim's shell context.

Critical Impact
Successful exploitation grants arbitrary command execution in the completing user's shell, compromising confidentiality, integrity, and availability of that user's session and accessible resources.

Affected Products

environment-modules (envmodules/modules) — versions prior to the patched release referenced in GHSA-8hrw-p88g-qhmg
Red Hat Enterprise Linux distributions shipping vulnerable environment-modules packages
Linux HPC and scientific computing environments relying on Environment Modules for shell provisioning

Discovery Timeline

2026-09-15 - CVE-2026-85013 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85013

Vulnerability Analysis

The flaw resides in the Bash completion logic shipped with environment-modules. When a user presses Tab after typing module or ml, the completion script enumerates modulefiles found under directories listed in the MODULEPATH environment variable. Rather than treating candidate module names as inert strings, the completion routine passes them through a shell evaluation context. Any shell metacharacters embedded in a filename are interpreted by Bash at completion time.

An attacker with local access needs only write permission to any directory present in a victim's MODULEPATH. This condition frequently arises in shared multi-user systems, HPC clusters, and environments where module directories are group-writable or where users add personal module directories to their path.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Modulefile names are treated as trusted input during completion expansion, but their contents originate from the filesystem and can be controlled by any user who can create files in a MODULEPATH directory. The completion helper does not quote or sanitize these names before they reach shell evaluation.

Attack Vector

Exploitation requires local access, low privileges, and user interaction. The attacker creates a modulefile whose filename embeds shell metacharacters such as command substitution or backticks. When the victim triggers Bash completion for module or ml, the metacharacters execute as commands under the victim's UID. No elevated privileges are required to place the file, but the payload executes with the victim's permissions, enabling lateral compromise of that user's data and accessible services.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-8hrw-p88g-qhmg for coordinated technical detail.

Detection Methods for CVE-2026-85013

Indicators of Compromise

Modulefiles with unusual filenames containing shell metacharacters such as backticks, $(), semicolons, or pipes located under any directory referenced by MODULEPATH.
Unexpected child processes spawned from interactive Bash sessions immediately after module or ml tab-completion events.
New or modified files in world-writable or group-writable directories that appear in users' MODULEPATH values.

Detection Strategies

Audit all directories listed in every user's MODULEPATH for filenames that contain non-alphanumeric shell metacharacters.
Enable shell auditing (for example, Bash PROMPT_COMMAND logging or auditd on execve) to capture unexpected process launches associated with completion activity.
Correlate filesystem creation events in shared module directories with subsequent shell command executions by other users.

Monitoring Recommendations

Monitor write access to shared module directories using auditd file watches on each path in the system-wide MODULEPATH.
Alert on any process whose parent is an interactive shell and whose command line contains substrings from module filenames.
Review permissions on module directories periodically and flag any that are writable by non-administrative users.

How to Mitigate CVE-2026-85013

Immediate Actions Required

Upgrade environment-modules to the fixed version referenced in the Red Hat advisory for CVE-2026-85013 and GHSA-8hrw-p88g-qhmg.
Inventory every directory referenced by MODULEPATH on multi-user systems and remove any modulefile whose name contains shell metacharacters.
Restrict write permissions on shared module directories to trusted administrators only.

Patch Information

Apply the vendor patch published in the upstream envmodules repository and distributed through Red Hat and other Linux vendors. Refer to Red Hat Bug Report #2465635 for package version details specific to Red Hat Enterprise Linux. Rebuild or reinstall the affected package across all cluster nodes, login nodes, and developer workstations.

Workarounds

Disable Bash completion for the module and ml commands until patches are applied by removing or unsourcing the environment-modules completion script.
Remove user-writable directories from the system-default MODULEPATH and require users to explicitly opt in to personal module paths.
Enforce filename validation on module directories through a filesystem monitoring script that quarantines files whose names contain shell metacharacters.

bash

# Configuration example: audit MODULEPATH directories and disable completion

# 1. Inspect current MODULEPATH entries
echo "$MODULEPATH" | tr ':' '\n'

# 2. Search for suspicious modulefile names containing shell metacharacters
for dir in $(echo "$MODULEPATH" | tr ':' ' '); do
  find "$dir" -type f \( -name '*`*' -o -name '*$*' -o -name '*;*' -o -name '*|*' \) 2>/dev/null
done

# 3. Temporarily disable module/ml Bash completion until patched
complete -r module 2>/dev/null
complete -r ml 2>/dev/null

# 4. Restrict write permissions on shared module directories
chmod 755 /usr/share/Modules/modulefiles
chown root:root /usr/share/Modules/modulefiles