CVE-2026-48120: Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kakouneto a version that resolves this vulnerability.Fixed in 2026.05.21 - Configuration
As a workaround, add `autorestore-disable` to the user `kakrc` to disable the autorestore feature.
Kakoune autorestore (autorestore.kak) autorestore-disable = added to user kakrc
Event History
Frequently Asked Questions
What is CVE-2026-48120?
CVE-2026-48120 is a high severity vulnerability in Kakoune that allows remote code execution through malicious backup files in the autorestore feature.
What is the severity of CVE-2026-48120?
The severity of CVE-2026-48120 is high with a CVSS score of 8.6.
How do I fix CVE-2026-48120?
To fix CVE-2026-48120, upgrade Kakoune to version 2026.05.21 or later.
What are the risks associated with CVE-2026-48120?
The risks of CVE-2026-48120 include arbitrary code execution which can potentially lead to system compromise when opening malicious files.
Who is affected by CVE-2026-48120?
Users of Kakoune prior to version 2026.05.21 are affected by CVE-2026-48120, especially those utilizing the autorestore feature.