GNU Nano vulnerabilities

4 CVEs affecting GNU Nano, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-6843, published 2026-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-1160, published 2010-04-16. Low severity, CVSS 1.9. EPSS: 0.4% chance of exploitation in the next 30 days. GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a…
CVE-2024-5742, published 2024-06-12. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the…
CVE-2010-1161, published 2010-04-16. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related…
CVE-2026-6843, published 2026-04-22. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application…