Shell Command Injection in nnn
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-65612
- 2026-10-03 Alias added: GHSA-mxcx-xvcg-f843
References
More nnn vulnerabilities
- TI-2026-46774 Shell Command Injection in nnn CVSS 4.0MEDIUM 5.1
- TI-2026-46773 Numeric Truncation Error in nnn CVSS 4.0LOW 2.4
- TI-2026-46772 Out-of-bounds write in nnn CVSS 4.0LOW 2.4
Sources
- CVE-2026-65612 · CVE Program
- CVE-2026-65612 · NVD
- FIRST EPSS
- GHSA-mxcx-xvcg-f843 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-65612 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences