CVE-2024-5742

MediumCVSS 6.7

Published: 12/06/2024(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

A vulnerability was found in GNU Nano allowing possible privilege escalation through an insecure temporary file. If Nano is killed while editing, it saves an emergency file with the permissions of the running user, giving attackers a window to escalate privileges via a malicious symlink.

Risk Assessment

A local attacker could exploit the emergency file to escalate privileges and take over a higher-privileged account. This poses a serious threat on shared multi-user systems.

Recommendation

Update GNU Nano to a version containing the fix. Until then, avoid editing files in shared directories and consider restricting access to emergency files.

Other vulnerabilities in GNU Nano

CVE-2026-6390Medium
A format string vulnerability was found in GNU nano's multi-buffer error message handling. A specially crafted filename with printf format specifiers can lead to stack information disclosure, denial of service, or arbitrary memory writes.

Original NVD description (English source)

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS