This page lists publicly disclosed CVE vulnerabilities affecting gnu nano (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-6843 | A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application. | [email protected] | 5.5 | 0.11% | 2026-04-22 | 2026-05-20 |
| CVE-2024-5742 | A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink. | [email protected] | 6.7 | 0.34% | 2024-06-12 | 2024-11-21 |
| CVE-2010-1161 | Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files. | [email protected] | 3.7 | 0.27% | 2010-04-16 | 2026-04-29 |
| CVE-2010-1160 | GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim. | [email protected] | 1.9 | 0.37% | 2010-04-16 | 2026-04-29 |