navi EUVD-2026-87945

Exploitation requires that the attacker control a cheatsheet variable value or a file name within a navi suggestion command directory (the crafted content must be delivered to and imported by the victim, e.g. via a shared/poisoned cheatsheet repo). The victim must then run navi locally and invoke the affected cheatsheet/suggestion so the unescaped value is substituted into a shell command - this is the required user interaction (UI:P) and the attack requirement (AT:P). It is local (AV:L), not network-reachable, and no authentication to navi itself is needed (PR:N). Limiting factors: navi is an interactive developer CLI, so exploitation hinges on social-engineering the victim into using attacker-influenced cheatsheet content, and code execution is confined to the victim user's own privileges. Affected: navi through 2.24.0.

The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P) and 7.3 score describe a local, interaction-and-condition-dependent command-injection flaw, not a remotely-triggerable RCE. Despite the HIGH banner, the real-world exploitability is bounded: AV:L means the malicious cheatsheet/suggestion-command directory content must already reach the victim's machine, AT:P indicates a specific attack requirement (a crafted file name in a suggestion command directory), and UI:P requires the victim to actually run navi and invoke the affected cheatsheet. The VC:H/VI:H/VA:H impact is credible because successful injection yields arbitrary command execution with the victim's privileges (CWE-78). There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - so this is 'no public exploit identified at time of analysis.' Net: a legitimately high-impact bug but low probability of opportunistic mass exploitation; it is a targeted/social-engineering-shaped threat (poisoned shared cheatsheets or repos), i.e. a real but not urgent priority. Signals are internally consistent - no network-vs-local contradiction - the only conflict is the HIGH numeric score versus the several limiting conditions (local access, attack requirement, user interaction).

An attacker publishes or contributes a navi cheatsheet repository (or supplies a suggestion command directory) containing a file whose name embeds shell metacharacters. When a victim imports and uses that cheatsheet, navi substitutes the unescaped variable value into a shell command, executing the attacker's payload with the victim's privileges. No public proof-of-concept is referenced in the provided data; exploitation requires local delivery of the crafted content plus the victim invoking the affected suggestion.