Gnu · Nano · CVE-2026-40556
**Name of the Vulnerable Software and Affected Versions**
GNU nano versions prior to 9.0
**Description**
GNU nano creates the user's `~/.local` directory with overly permissive permissions when it does not already exist. During the first use of features requiring Cross-Desktop Group (XDG) data storage, the software requests directory mode 0777. In environments with a relaxed or zero umask (such as container environments, CI/CD runners, embedded systems, or shells configured with umask 000), this makes the directory world-writable. A local attacker can exploit a race window between the creation of `~/.local` and the subsequent creation of more restrictive subdirectories to write controlled files into the victim's XDG directory hierarchy.
**Recommendations**
Update to version 9.0.