CVE-2026-101032CWE-78command-injection

CVE-2026-101032

High · published September 27, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00148 · 3.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-27T18:16Z
References (5)
https://github.com/denisidoro/navi · [email protected]https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/commands/core/actor.rs#L159-L193 · [email protected]https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/common/shell.rs#L39-L50 · [email protected]https://github.com/denisidoro/navi/issues/1037 · [email protected]https://www.vulncheck.com/advisories/navi-through-2.24.0-os-command-injection-via-cheatsheet-variables · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 13:16Z
    navi through 2.24.0 OS Command Injection via Cheatsheet Variables
    cvelistv5