A flaw in nano causes the ~/.local directory to be created with insecure permissions (0777 instead of the intended 0700) when the system umask is permissive. This allows a local attacker to place a malicious .desktop file into the directory, which the desktop environment may execute or process, potentially leading to unintended actions or information disclosure. The weakness stems from insecure permissions (CWE-732) and is exploitable by any user able to write to the affected directory. The primary impact is local code execution through a seemingly innocuous launcher file, and if the launcher triggers privileged commands, this could elevate the attacker’s capabilities.

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10, as well as Red Hat OpenShift Container Platform 4. Users of these distributions who run nano on a system with a permissive umask are at risk, regardless of the specific minor version or patch level, because the directory permissions reasoning remains unchanged. The issue is tied to nano’s default directory creation behavior and the overall system configuration.

The CVSS base score is 2.5, reflecting the local scope and modest impact. EPSS is not available, which indicates no known exploitation data at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The likely attack vector is a local user with the ability to write to the affected directory; an attacker would craft a malicious .desktop file and allow the desktop environment to process it. The risk is moderate but can be mitigated with a simple configuration change.