DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-HC4M-Q9JH-XW4J: GHSA-hc4m-q9jh-xw4j: Registry Pack Verification Fail-Open Vulnerability in nono-cli

#security #cve #cybersecurity #ghsa

GHSA-hc4m-q9jh-xw4j: Registry Pack Verification Fail-Open Vulnerability in nono-cli

Vulnerability ID: GHSA-HC4M-Q9JH-XW4J
CVSS Score: 6.6
Published: 2026-07-28

The nono-cli package verification mechanism fails open when both the lockfile entry and local trust bundle are absent. This allows local attackers to execute unverified package profiles and native host session hooks by removing metadata configurations, bypassing cryptographic integrity controls.

TL;DR

A fail-open flaw in nono-cli version 0.61.2 and earlier allows unverified packages to execute on the host machine by simply deleting their local metadata and lockfile files.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-636
  • Attack Vector: Local (AV:L)
  • CVSS Severity: 6.6 Medium
  • Impact: High Confidentiality, High Integrity (C:H/I:H)
  • Exploit Status: Proof of Concept (PoC)
  • First Patched Version: 0.61.3 / v0.62.0

Affected Systems

  • nono-cli
  • nono profile runtime
  • nono-cli: <= 0.61.2 (Fixed in: 0.61.3)

Code Analysis

Commit: db07375

Enforce strict lockfile and bundle verification in nono-cli

Exploit Details

Mitigation Strategies

  • Upgrade nono-cli to version 0.61.3 or higher.
  • Deploy File Integrity Monitoring (FIM) over the ~/.config/nono directory.
  • Restrict local configuration write permissions to root or authorized owners only.

Remediation Steps:

  1. Identify installed instances of nono-cli and query versions using 'nono --version'.
  2. Update the utility using the cargo package manager or system-specific installation scripts to v0.62.0.
  3. Verify configuration status using 'nono verify' against existing packs.
  4. If lockfiles are missing, execute recovery with 'nono pull --force' to securely reconstruct trust bundles.

References

Read the full report for GHSA-HC4M-Q9JH-XW4J on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)