Re: [Lmod-users] Fw: [SECURITY] Lmod 9.4 released (CVE-2026-85013)

[Robert M. <rt...@gm...>]

Just copy the init/lmod_bash_completions from init/lmod_bash_completions to
your your installed copy.


On Tue, Sep 8, 2026 at 4:56 PM Kenneth Dalenberg <kd...@oa...>
wrote:

> This was forwarded to me today, I still have to look around some more, but
> can you elaborate on replacing lmod_bash_completions?  We install lmod on
> our slurm cluster nodes via openhpc which is at lmod 9.2.
>
> Where can I find a fixed version of the bash completion script?
>
>
> KEN DALENBERG
> Linux System Administrator
> Office of Advanced Research Computing
> Rutgers, The State University of New Jersey
> Busch Campus, CoRE Building, 96 Frelinghuysen Road, Piscataway, NJ 08854
> <https://www.google.com/maps/search/96+Frelinghuysen+Road,+Piscataway,+NJ+08854?entry=gmail&source=g>
> kd...@oa...
> 848-445-5248 <(848)%20445-5248>
>
>
> ------------------------------
> *From:* Shahzeb Siddiqui <sha...@gm...>
> *Sent:* Tuesday, September 8, 2026 10:46 AM
> *To:* OIT/EISD - Platform Research Systems <
> eis...@oi...>
> *Subject:* Fwd: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)
>
> FYI
>
> ---------- Forwarded message ---------
> From: *Robert McLay* <rt...@gm...>
> Date: Tue, Sep 8, 2026 at 9:47 AM
> Subject: Re: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)
> To: Martin Schroschk <mar...@tu...>
> Cc: lmo...@li... <lmo...@li...>
>
>
> Thanks for the question.  Yes, it affects 8.7, in fact it affects every
> version of Lmod since bash tab completions was added.  I just checked Lmod
> 5.0 (from 2013) and it had the vulnerability.  So yes, every site using
> Lmod should upgrade.  Or they can remove or replace
> lmod_bash_completions.
>
> Best,
> Lmod Team
>
>
>
>
> On Tue, Sep 8, 2026 at 3:28 PM Martin Schroschk <
> mar...@tu...> wrote:
>
> Dear Robert,
>
> thanks for the information.
>
> Does the CVE-2026-8501 also affect version 8.7?
>
> Best regards
> Martin
>
> Am Dienstag, dem 08.09.2026 um 11:42 +0200 schrieb Robert McLay:
> > Hello All,
> >
> > Lmod 9.4 is released.  This release fixes CVE-2026-85013 where a
> security vulnerability
> > was found in the Bash completion script of the module and ml commands.
> This only
> > affects bash.  Other shells do not have this vulnerability. The tool
> compgen can cause a
> > problem with a badly formed filename (and not the contents) can allow a
> local
> > attacker to execute arbitrary commands as the victim.
> >
> > Please upgrade immediately to Lmod 9.4.
> >
> > If upgrading is not immediately possible, the fixed Bash completion
> script can be
> > installed on its own, as the fix only touches this file. As an interim
> workaround, Bash
> > completion for module and ml can be disabled by removing the completion
> script from the
> > Bash completion directory.
> >
> > Special thanks to AISLE and Red Hat who found and reported this
> vulnerability..  Thanks
> > also to Xavier Delaruelle for report this issue to us.  Thanks also  to
> Matthew Cawood
> > for implementing our fix and a test.
> >
> > Best,
> > Lmod Team
> >
> > _______________________________________________
> > Lmod-users mailing list
> > Lmo...@li...
> > https://lists.sourceforge.net/lists/listinfo/lmod-users
>
> _______________________________________________
> Lmod-users mailing list
> Lmo...@li...
> https://lists.sourceforge.net/lists/listinfo/lmod-users
>