CVE-2026-101032 in navi
Summary
by MITRE • 09/27/2026
navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in navi versions prior to 2.24.0 represents a critical server-side request forgery and remote code execution risk stemming from improper input validation within the application's shell integration layer. Navi is an interactive cheatsheet tool that allows users to search, filter, and execute command-line snippets. The core flaw lies in how the software handles variable substitution when constructing shell commands for execution. Specifically, when a user selects a suggestion or snippet, navi substitutes variables into the command string before passing it to the system shell for interpretation. In versions up to 2.24.0, this process fails to adequately sanitize or escape special characters present in the source data of these variables. This lack of proper escaping creates an injection vector that allows malicious actors to alter the intended structure of the executed command.
The technical mechanism of exploitation relies on the ability to inject shell metacharacters through crafted file names located within suggestion directories. Navi typically scans specific directories for cheat sheet files, often using filenames or metadata as part of the variable values displayed to the user. If an attacker gains write access to these directories, or if they can influence the content via a shared network location or compromised build pipeline, they can create files with names containing shell metacharacters such as semicolons, pipes, backticks, or dollar signs. When navi processes these entries and substitutes them into a command template without escaping, the injected characters are interpreted by the underlying operating system's shell rather than being treated as literal string data. This allows an attacker to terminate the intended command and append arbitrary commands for execution.
The operational impact of this vulnerability is severe, resulting in remote code execution with the privileges of the user running navi. Since developers frequently use such tools within their primary development environments or production servers where they possess elevated permissions, successful exploitation can lead to full system compromise. An attacker could exfiltrate sensitive data, install backdoors, pivot to other systems on the network, or disrupt service availability by executing destructive commands. The risk is particularly acute in collaborative environments where cheat sheet directories are shared across multiple users or integrated into continuous integration and deployment pipelines that automatically populate suggestion lists from version-controlled repositories.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The failure to escape user-controllable input before its use in a system command is the defining characteristic of this class of defects. Furthermore, within the context of the MITRE ATT&CK framework, this behavior maps directly to T1059 Command and Scripting Interpreter, specifically under sub-techniques involving shell commands such as sh or bash. The exploitation vector also touches upon CWE-284 Improper Access Control if the vulnerability is leveraged through a shared directory structure where access controls are insufficiently restrictive against untrusted file creation.
Mitigation strategies must focus on immediate patching and architectural hardening. Organizations should upgrade navi to version 2.24.0 or later, as this release addresses the input sanitization logic by properly escaping variable values before shell substitution. In environments where upgrading is not immediately feasible, administrators should enforce strict file system permissions on suggestion directories to prevent unauthorized users from creating or modifying cheat sheet files. Additionally, implementing a whitelist approach for allowed characters in filenames within these directories can reduce the attack surface. Security teams should also audit existing cheat sheets and shared repositories for any pre-existing malicious entries that may have been planted prior to patching. Regular security training for development teams regarding safe shell scripting practices and input validation is essential to prevent similar vulnerabilities from being introduced in custom integrations or future updates.