CVE-2026-65611: Shell Command Injection in nnn
nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the crafted directory name is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who browse untrusted shared filesystems, removable media, or extracted archives with nnn are exposed if an attacker can place a specially named directory in a location the user opens. The payload runs with the privileges of the user running nnn.
What interaction is required for exploitation?
The victim must enter the attacker-controlled directory in nnn and use its batch copy or move workflow. Merely having the crafted directory present is not described as sufficient.
Which versions are known to be affected?
Version 5.2 was tested and confirmed vulnerable. No vulnerable version range was provided, and the maintainer may have addressed the issue without specifying affected or fixed versions.
What can be done before a confirmed fix is available?
Avoid using nnn's batch copy or move workflow after entering directories from untrusted shared storage, removable media, or extracted archives. Treat directory names in those locations as untrusted, especially names containing a single quote and shell syntax.