Skip to main content
CVE-2026-40556VulnerabilityPublished Updated

SUSE · Security update for nano

Affects SUSESource GCVE Database

0

Mentioned vulnerabilities

Not known to be exploited · fixed in SUSE package updates : update SUSE when convenient.

Data as of 15 Oct 2026, 22:06 UTC

Severity
Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

Patch
Available – fixed in 9.1

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 29 Jun 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Description

This update for nano fixes the following issues: Changes in nano: - Update to version 9.1: * When searching, the viewport is placed snug left where possible. * The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed. * The ^T toggle between WhereIs and GotoLine was dropped. * Fix backups that were missing or had a wrong timestamp when --backup is active. * On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner. * The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream). * M-Ins and M-Del have become rebindable. - GNU nano 9.0: * When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling. * The viewport can be scrolled sideways (in steps of one tabsize) with M-< and M->. See `man nanorc` if M-< and M-> should switch between buffers (as they did earlier). * M-Left, M-Right, M-Up, and M-Down have become rebindable. * Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place. * Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle. * With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer. * CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643) * create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437) - GNU nano 8.7.1: * fix build against glibc-2.43 (boo#1258260) - GNU nano 8.7: * At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc

References

Community reviews

Loading reviews…