---
id: CVE-2026-101032
title: >-
  navi through 2.24.0 fails to properly escape cheatsheet variable values when
  substituting them into shell commands
summary: >-
  navi through 2.24.0 fails to properly escape cheatsheet variable values when
  substituting them into shell commands. Attackers can inject shell
  metacharacters through crafted file names in suggestion command directories to
  execute arbitra…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: denisidoro
product: navi
affected:
  - navi <= 2.24.0
published: '2026-09-27'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T14:16:28.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101032'
references:
  - url: 'https://github.com/denisidoro/navi'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/commands/core/actor.rs#L159-L193
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/denisidoro/navi/blob/5515367dc8a2a561d2d82b8352f729b1da4120d3/src/common/shell.rs#L39-L50
    label: disclosure@vulncheck.com
  - url: 'https://github.com/denisidoro/navi/issues/1037'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/navi-through-2.24.0-os-command-injection-via-cheatsheet-variables
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-27T13:53:26.577Z'
---

## Overview

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.