CVE-2026-65612: Shell Command Injection in nnn
nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of nnn who browse untrusted shared filesystems, removable media, or extracted archives are exposed if they navigate to and open a file with a crafted filename using preview-tabbed. The injected command runs with the privileges of the affected nnn process.
What must an attacker do to exploit it?
An attacker needs to place a file whose name contains a single quote followed by shell syntax in a location the victim will browse. Exploitation requires the victim to navigate to that file and open it with preview-tabbed.
Are all nnn versions known to be affected?
Only version 5.2 was tested and confirmed vulnerable. No vulnerable version range was provided, and the issue may have been addressed after maintainer notification.