CVE-2026-85013 is a local privilege vulnerability in environment-modules where an attacker can place a maliciously named modulefile in a MODULEPATH directory. When the victim triggers Bash completion for the module or ml commands, the shell evaluates the malicious module name containing shell metacharacters as a command. This leads to arbitrary command execution within the victim's shell context.

Successful exploitation allows arbitrary command execution in the victim's shell, impacting confidentiality, integrity, and availability of the affected system. The attacker requires local access and the ability to place files in a MODULEPATH directory visible to the victim.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using Bash completion for module or ml commands in untrusted environments or restrict write access to MODULEPATH directories to trusted users only.