HIGH 7.3 NVD
CVE-2026-101032
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters th
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.
References
- https://github.com/denisidoro/navi
- https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/comma
- https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/commo
- https://github.com/denisidoro/navi/issues/1037
- https://www.vulncheck.com/advisories/navi-through-2.24.0-os-command-injection-via-cheatshe
This high severity vulnerability with a CVSS score of 7.3 was published on 2026-09-27 via NVD.
vulnfeed aggregates 11720 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.