Navi
Monthly
Command injection in navi through 2.24.0 allows an attacker who controls cheatsheet variable values - or file names inside a suggestion command directory - to have unescaped shell metacharacters substituted into commands that navi executes with the victim's privileges. Exploitation is local and condition-dependent: the crafted content must reach the victim (for example through a shared or poisoned cheatsheet repository) and the victim must interactively invoke the affected cheatsheet, after which arbitrary commands run at the user's own privilege level. No public exploit code was identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 4.0 score of 7.3 reflects high confidentiality, integrity, and availability impact on the victim's account once the conditions are met.
Command injection in navi through 2.24.0 allows an attacker who controls cheatsheet variable values - or file names inside a suggestion command directory - to have unescaped shell metacharacters substituted into commands that navi executes with the victim's privileges. Exploitation is local and condition-dependent: the crafted content must reach the victim (for example through a shared or poisoned cheatsheet repository) and the victim must interactively invoke the affected cheatsheet, after which arbitrary commands run at the user's own privilege level. No public exploit code was identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 4.0 score of 7.3 reflects high confidentiality, integrity, and availability impact on the victim's account once the conditions are met.