Improper Permissions in GNU Nano Allows Local File Manipulation

CVE-2026-40556

What is CVE-2026-40556?

GNU Nano improperly sets permissions for the user's ~/.local directory when it is created for the first time. It assigns overly permissive mode 0777, making this directory world-writable, particularly in environments with relaxed umask settings. This poses a significant risk in container environments, CI/CD runners, and certain system configurations where the umask is set to 000. A local attacker can exploit the timing between the creation of ~/.local and subdirectories to inject malicious files into the XDG directory hierarchy, thereby compromising user security.

References