CVE-2026-121548: nnn through 5.3 OS Command Injection via togglex Plugin

Published Nov 3, 2026

Updated

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

Who is exposed to this issue?

Users of nnn through 5.3 are exposed when they invoke the togglex plugin on directories containing attacker-controlled filenames. The injected command runs with the privileges of the user who invokes togglex.

What must an attacker do to exploit it?

An attacker must be able to place a file with a crafted name containing a double quote and shell syntax in a location processed by togglex. Exploitation also requires a user to invoke the plugin on that content.

Is user interaction required?

Yes. The affected user must invoke togglex; the supplied severity vector also identifies user interaction as required.

What can be done if updating is not immediately possible?

Avoid invoking the togglex plugin on directories that contain files from untrusted sources. Treat filenames in shared, downloaded, or otherwise attacker-writable locations as potentially malicious.

CVE-2026-121548: nnn through 5.3 OS Command Injection via togglex Plugin

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

What can be done if updating is not immediately possible?