Re: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)

[Robert M. <rt...@gm...>]

It is the same vulnerability.

Best
Lmod Team


On Tue, Sep 8, 2026, 20:31 Rahaman, Ronald O via Lmod-users <
lmo...@li...> wrote:

> Is there a POC for the exploit in lmod?
>
> Envmodules posted updates about CVE-2026-85013 (for example,
> https://bsky.app/profile/envmodules.bsky.social/post/3muvsdeyx622g) that
> linked to a POC for envmodules (
> https://github.com/envmodules/modules/security/advisories/GHSA-8hrw-p88g-qhmg
> ).
>
> Best,
> Ron
>
> --------
> *Ron Rahaman : Senior Research Scientist : Partnership for an Advanced
> Computing Environment : Georgia Institute of Technology*
> ------------------------------
> *From:* Robert McLay <rt...@gm...>
> *Sent:* Tuesday, September 8, 2026 8:46 AM
> *To:* Martin Schroschk <mar...@tu...>
> *Cc:* lmo...@li... <lmo...@li...>
> *Subject:* Re: [Lmod-users] [SECURITY] Lmod 9.4 released (CVE-2026-85013)
>
> Thanks for the question.  Yes, it affects 8.7, in fact it affects every
> version of Lmod since bash tab completions was added.  I just checked Lmod
> 5.0 (from 2013) and it had the vulnerability.  So yes, every site using
> Lmod should upgrade.  Or they can remove or replace
> lmod_bash_completions.
>
> Best,
> Lmod Team
>
>
>
>
> On Tue, Sep 8, 2026 at 3:28 PM Martin Schroschk <
> mar...@tu...> wrote:
>
> Dear Robert,
>
> thanks for the information.
>
> Does the CVE-2026-8501 also affect version 8.7?
>
> Best regards
> Martin
>
> Am Dienstag, dem 08.09.2026 um 11:42 +0200 schrieb Robert McLay:
> > Hello All,
> >
> > Lmod 9.4 is released.  This release fixes CVE-2026-85013 where a
> security vulnerability
> > was found in the Bash completion script of the module and ml commands.
> This only
> > affects bash.  Other shells do not have this vulnerability. The tool
> compgen can cause a
> > problem with a badly formed filename (and not the contents) can allow a
> local
> > attacker to execute arbitrary commands as the victim.
> >
> > Please upgrade immediately to Lmod 9.4.
> >
> > If upgrading is not immediately possible, the fixed Bash completion
> script can be
> > installed on its own, as the fix only touches this file. As an interim
> workaround, Bash
> > completion for module and ml can be disabled by removing the completion
> script from the
> > Bash completion directory.
> >
> > Special thanks to AISLE and Red Hat who found and reported this
> vulnerability..  Thanks
> > also to Xavier Delaruelle for report this issue to us.  Thanks also  to
> Matthew Cawood
> > for implementing our fix and a test.
> >
> > Best,
> > Lmod Team
> >
> > _______________________________________________
> > Lmod-users mailing list
> > Lmo...@li...
> > https://lists.sourceforge.net/lists/listinfo/lmod-users
>
> _______________________________________________
> Lmod-users mailing list
> Lmo...@li...
> https://lists.sourceforge.net/lists/listinfo/lmod-users
>