The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability     was found in gradle-completion up to and including 9.3.0 that allows arbitrary code execution when a user     triggers Bash tab completion in a project containing a malicious Gradle build file. The `gradle-     completion` script for Bash fails to adequately sanitize Gradle task names and task descriptions, allowing     command injection via a malicious Gradle build file when the user completes a command in Bash (without     them explicitly running any task in the build). For example, given a task description that includes a     string between backticks, then that string would be evaluated as a command when presenting the task     description in the completion list. While task execution is the core feature of Gradle, this inherent     execution may lead to unexpected outcomes. The vulnerability does not affect zsh completion. The first     patched version is 9.3.1. As a workaround, it is possible and effective to temporarily disable bash     completion for Gradle by removing `gradle-completion` from `.bashrc` or `.bash_profile`. (CVE-2026-25063)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-25063

high Nessus Plugin ID 297268

Version 1.2

Version 1.1

Version 1.2 Feb 4, 2026, 8:43 PM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Detection (updated detection logic) Plugin metadata Plugin Feed: 202602042043
Version 1.1 Jan 31, 2026, 11:07 AM New Plugin Feed: 202601311107