Read the docs
TI-2026-84356 Aliases CVE-2026-121550GHSA-96gh-683j-p43h

Symlink-following write in nnn via NNN_FIFO handling

Priority LOW 6CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

nnn through 5.3 does not verify that an existing NNN_FIFO path is a FIFO when main() starts. This improper link resolution flaw (CWE-59) lets a local attacker with low privileges pre-create the predictable /tmp/nnn.fifo path as a symlink or readable regular file. When a victim uses nnn, writes can overwrite victim-writable files or leak the victim's browsed paths.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.

Why it matters now

EPSS 0.00116 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jarunnnnup to 5.3—No fix listedCNA
  • nnn Vendorjarun Affected up to 5.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for nnn.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121550
  2. 2026-11-03 Alias added: GHSA-96gh-683j-p43h
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat

References

Patch 1

Other 4

  • TI-2026-84354 OS command injection in nnn togglex plugin via crafted filenames CVSS 4.0HIGH 8.4
  • TI-2026-84355 nnn Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins CVSS 4.0MEDIUM 4.1
  • TI-2026-85580 Server-side request forgery in Buku bukuserver reaches internal hosts CVSS 4.0MEDIUM 6.3
  • TI-2026-84450 Stored cross-site scripting in buku bookmark list via bookmark URL CVSS 4.0MEDIUM 5.3
  • TI-2025-12396 jarun nnn nnn.c run_cmd_as_plugin double free CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences