CVE-2026-85013 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for environment-modules installations, especially in multi-user environments, should assess exposure and implement mitigations.

Why it matters

CVE-2026-85013 allows local attackers to execute arbitrary commands via malicious modulefiles in environment-modules, impacting confidentiality, integrity, and availability. System administrators and security teams should assess exposure, verify versions, and implement compensating controls.

• Local attackers may execute arbitrary commands in users' shells
• Confidentiality, integrity, and availability may be compromised
• Verification of environment-modules versions and configurations is necessary
• Remediation priority is high due to potential for exploitation

Technical summary

The environment-modules package is vulnerable to a flaw that allows local attackers to execute arbitrary commands. This occurs when a maliciously named modulefile is placed in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell.

Defensive priority

High-priority assessment and remediation recommended for systems using environment-modules, especially where local attackers may have access.

Recommended defensive actions

• Assess exposure of environment-modules installations to local attackers
• Verify and update environment-modules to the latest version
• Implement compensating controls, such as restricting access to modulefile locations
• Monitor for suspicious activity related to modulefile usage
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.3 and severity of HIGH. Red Hat has provided references to errata and security pages. The vulnerability allows local attackers to execute arbitrary commands via malicious modulefiles in environment-modules, impacting confidentiality, integrity, and availability. The NVD entry provides additional information on the vulnerability and its potential impact. The CVE Program record provides source-provided CVE metadata. The Red Hat errata page (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.