AZL-85557

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-85557.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-85557
Upstream
Published
2026-04-22T08:16:13Z
Modified
2026-09-01T05:28:09Z
Summary
CVE-2026-6842 affecting package nano for versions less than 6.4-3
Details

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the ~/.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

References

Affected packages

Azure Linux:3 / nano

Package

Name
nano
Purl
pkg:rpm/azure-linux/nano

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.4-3

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-85557.json"