Re: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)

[Rahaman, R. O <rra...@ga...>]

Is there a POC for the exploit in lmod?

Envmodules posted updates about CVE-2026-85013 (for example, https://bsky.app/profile/envmodules.bsky.social/post/3muvsdeyx622g) that linked to a POC for envmodules (https://github.com/envmodules/modules/security/advisories/GHSA-8hrw-p88g-qhmg).

Best,
Ron

--------
Ron Rahaman : Senior Research Scientist : Partnership for an Advanced Computing Environment : Georgia Institute of Technology
________________________________
From: Robert McLay <rt...@gm...>
Sent: Tuesday, September 8, 2026 8:46 AM
To: Martin Schroschk <mar...@tu...>
Cc: lmo...@li... <lmo...@li...>
Subject: Re: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)

Thanks for the question.  Yes, it affects 8.7, in fact it affects every version of Lmod since bash tab completions was added.  I just checked Lmod 5.0 (from 2013) and it had the vulnerability.  So yes, every site using Lmod should upgrade.  Or they can remove or replace lmod_bash_completions.

Best,
Lmod Team




On Tue, Sep 8, 2026 at 3:28 PM Martin Schroschk <mar...@tu...<mailto:mar...@tu...>> wrote:
Dear Robert,

thanks for the information.

Does the CVE-2026-8501 also affect version 8.7?

Best regards
Martin

Am Dienstag, dem 08.09.2026 um 11:42 +0200 schrieb Robert McLay:
> Hello All,
>
> Lmod 9.4 is released.  This release fixes CVE-2026-85013 where a security vulnerability
> was found in the Bash completion script of the module and ml commands.  This only
> affects bash.  Other shells do not have this vulnerability. The tool compgen can cause a
> problem with a badly formed filename (and not the contents) can allow a local
> attacker to execute arbitrary commands as the victim.
>
> Please upgrade immediately to Lmod 9.4.
>
> If upgrading is not immediately possible, the fixed Bash completion script can be
> installed on its own, as the fix only touches this file. As an interim workaround, Bash
> completion for module and ml can be disabled by removing the completion script from the
> Bash completion directory.
>
> Special thanks to AISLE and Red Hat who found and reported this vulnerability..  Thanks
> also to Xavier Delaruelle for report this issue to us.  Thanks also  to Matthew Cawood
> for implementing our fix and a test.
>
> Best,
> Lmod Team
>
> _______________________________________________
> Lmod-users mailing list
> Lmo...@li...<mailto:Lmo...@li...>
> https://lists.sourceforge.net/lists/listinfo/lmod-users