Re: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)

[Robert M. <rt...@gm...>]

Thanks for the question.  Yes, it affects 8.7, in fact it affects every
version of Lmod since bash tab completions was added.  I just checked Lmod
5.0 (from 2013) and it had the vulnerability.  So yes, every site using
Lmod should upgrade.  Or they can remove or replace lmod_bash_completions.

Best,
Lmod Team




On Tue, Sep 8, 2026 at 3:28 PM Martin Schroschk <
mar...@tu...> wrote:

> Dear Robert,
>
> thanks for the information.
>
> Does the CVE-2026-8501 also affect version 8.7?
>
> Best regards
> Martin
>
> Am Dienstag, dem 08.09.2026 um 11:42 +0200 schrieb Robert McLay:
> > Hello All,
> >
> > Lmod 9.4 is released.  This release fixes CVE-2026-85013 where a
> security vulnerability
> > was found in the Bash completion script of the module and ml commands.
> This only
> > affects bash.  Other shells do not have this vulnerability. The tool
> compgen can cause a
> > problem with a badly formed filename (and not the contents) can allow a
> local
> > attacker to execute arbitrary commands as the victim.
> >
> > Please upgrade immediately to Lmod 9.4.
> >
> > If upgrading is not immediately possible, the fixed Bash completion
> script can be
> > installed on its own, as the fix only touches this file. As an interim
> workaround, Bash
> > completion for module and ml can be disabled by removing the completion
> script from the
> > Bash completion directory.
> >
> > Special thanks to AISLE and Red Hat who found and reported this
> vulnerability..  Thanks
> > also to Xavier Delaruelle for report this issue to us.  Thanks also  to
> Matthew Cawood
> > for implementing our fix and a test.
> >
> > Best,
> > Lmod Team
> >
> > _______________________________________________
> > Lmod-users mailing list
> > Lmo...@li...
> > https://lists.sourceforge.net/lists/listinfo/lmod-users
>