nano - Debian Package Tracker

general

source: nano (main)
version: 9.1-1
maintainer: Jordi Mallach (DMD) (LowNMU)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.4-2+deb11u3
oldstable: 7.2-1+deb12u1
stable: 8.4-1+deb13u1
testing: 9.1-1
unstable: 9.1-1

versioned links

5.4-2+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.2-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.4-1+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

nano (15 bugs: 0, 7, 8, 0)
nano-tiny
nano-udeb

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-6390: A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Created: 2026-07-23 Last update: 2026-07-24 04:20

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-6390: A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Created: 2026-07-23 Last update: 2026-07-24 04:20

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-6390: A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

Created: 2026-07-23 Last update: 2026-07-24 04:20

3 security issues in bullseye high

There are 3 open security issues in bullseye.

1 important issue:

CVE-2026-6390: A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

2 issues postponed or untriaged:

CVE-2026-6842: (postponed; to be fixed through a stable update) A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
CVE-2026-6843: (postponed; to be fixed through a stable update) A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.

Created: 2026-07-23 Last update: 2026-07-24 04:20

3 security issues in bookworm high

There are 3 open security issues in bookworm.

1 important issue:

CVE-2026-6390: A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.

2 issues left for the package maintainer to handle:

CVE-2026-6842: (needs triaging) A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
CVE-2026-6843: (needs triaging) A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-04-23 Last update: 2026-07-24 04:20

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-25 05:30

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2026-02-09 Last update: 2026-07-03 11:32

news

[rss feed]

[2026-07-07] nano 9.1-1 MIGRATED to testing (Debian testing watch)
[2026-07-02] Accepted nano 9.1-1 (source) into unstable (Jordi Mallach)
[2026-05-10] Accepted nano 8.4-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Jordi Mallach)
[2026-04-27] nano 9.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-21] Accepted nano 9.0-1 (source) into unstable (Jordi Mallach)
[2026-02-20] nano 8.7.1-1 MIGRATED to testing (Debian testing watch)
[2026-02-08] Accepted nano 8.7.1-1 (source) into unstable (Jordi Mallach)
[2025-11-26] nano 8.7-1 MIGRATED to testing (Debian testing watch)
[2025-11-20] Accepted nano 8.7-1 (source) into unstable (Jordi Mallach)
[2025-08-28] nano 8.6-1 MIGRATED to testing (Debian testing watch)
[2025-08-22] Accepted nano 8.6-1 (source) into unstable (Jordi Mallach)
[2025-08-18] Accepted nano 8.5-1 (source) into unstable (Jordi Mallach)
[2025-04-12] nano 8.4-1 MIGRATED to testing (Debian testing watch)
[2025-04-06] Accepted nano 8.4-1 (source) into unstable (Jordi Mallach)
[2025-01-12] nano 8.3-1 MIGRATED to testing (Debian testing watch)
[2025-01-06] Accepted nano 8.3-1 (source) into unstable (Jordi Mallach)
[2024-10-03] nano 8.2-1 MIGRATED to testing (Debian testing watch)
[2024-09-28] Accepted nano 8.2-1 (source) into unstable (Jordi Mallach)
[2024-07-21] nano 8.1-1 MIGRATED to testing (Debian testing watch)
[2024-07-16] Accepted nano 8.1-1 (source) into unstable (Jordi Mallach)
[2024-06-19] Accepted nano 5.4-2+deb11u3 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2024-06-17] Accepted nano 3.2-3+deb10u1 (source) into oldoldstable (Adrian Bunk)
[2024-06-15] Accepted nano 7.2-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Jordi Mallach)
[2024-05-12] nano 8.0-1 MIGRATED to testing (Debian testing watch)
[2024-05-06] Accepted nano 8.0-1 (source) into unstable (Jordi Mallach)
[2024-01-22] nano 7.2-2 MIGRATED to testing (Debian testing watch)
[2024-01-17] Accepted nano 7.2-2 (source) into unstable (Jordi Mallach)
[2023-01-24] nano 7.2-1 MIGRATED to testing (Debian testing watch)
[2023-01-18] Accepted nano 7.2-1 (source) into unstable (Jordi Mallach)
[2022-12-20] nano 7.1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 15
RC: 0
I&N: 7
M&W: 8
F&P: 0
patch: 2

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 87)

ubuntu

[Information about Ubuntu for Debian Developers]

version: 9.1-1