What is the CVSS score of CVE-2026-48120?

CVE-2026-48120 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kakoune are affected by CVE-2026-48120?

Kakoune text editor versions prior to 2026.05.21 contain a command injection vulnerability that enables arbitrary system command execution when developers open files, potentially compromising…. A patch is available.

How to fix or mitigate CVE-2026-48120?

Within 24 hours: Identify all systems running Kakoune versions prior to 2026.05.21 through asset inventory and package managers. Within 7 days: Upgrade all affected Kakoune installations to version 2026.05.21 or later; if immediate upgrade is infeasible, disable the autorestore.kak script in user and system configuration directories. Within 30 days: Implement automated software compliance scanning to prevent deployment of versions prior to 2026.05.21 and establish Kakoune version control policies across development and operations teams.

Kakoune CVE-2026-48120

EUVD-2026-54719 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-08-07 GitHub_M

RCE Kakoune

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Local vector because attacker must pre-plant files on the filesystem; PR:N since file creation requires no elevated privileges; S:C because shell execution breaks out of the editor process boundary.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.6 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 07, 2026 - 23:21 vuln.today

Analysis Generated

Aug 07, 2026 - 23:21 vuln.today

Patch available

Aug 07, 2026 - 23:02 EUVD

CVE Published

Aug 07, 2026 - 22:34 cve.org

HIGH 8.6

DescriptionCVE.org

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.

AnalysisAI

Command injection via unsanitized backup filenames in Kakoune (all versions prior to 2026.05.21) enables arbitrary Kakoune script and shell command execution when a victim opens a file in the editor. The bundled autorestore.kak script - enabled by default - discovers backup files by pattern-matching filenames in the same directory as the opened file, then incorporates those filenames directly into shell command strings without validating special characters in the suffix component. No public standalone exploit has been identified at time of analysis, though the fix commit (25c7b13) includes test cases that explicitly demonstrate the injection pattern using filenames such as .out.kak.;"foo", confirming exploitability.

Technical ContextAI

Kakoune is a modal code editor (CPE: cpe:2.3:a:mawww:kakoune:*:*:*:*:*:*:*:*) inspired by Vim. Its rc/tools/autorestore.kak script, shipped and enabled by default, searches for session backup files matching the naming pattern .<basename>.kak.<suffix> in the directory of the file being opened. The root cause is CWE-74 (Injection - Improper Neutralization of Special Elements in Output Used by a Downstream Component): the script constructs Kakoune command strings and passes them to a shell using printf %s interpolation of the raw backup filename, without first validating that the suffix component is free of characters meaningful to the shell or Kakoune interpreter (semicolons, quotes, dollar signs, etc.). The commit diff confirms the fix: pathchk -p is invoked on the extracted suffix, and any filename whose suffix contains non-portable characters is silently ignored with a debug log entry rather than being processed. The pre-fix code used unquoted glob expansion of ${buffer_dirname}/.${buffer_basename}.kak.* whose matched results flowed directly into command construction.

RemediationAI

Upgrade Kakoune to version 2026.05.21 or later; this release introduces pathchk -p validation of backup file suffixes in autorestore.kak, rejecting any backup whose filename suffix contains characters outside the POSIX portable filename character set before it is used in command construction (upstream fix commit: https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825). For installations that cannot be immediately upgraded, add the line autorestore-disable to the user's kakrc configuration file; this disables the autorestore feature entirely, eliminating the attack surface at the cost of losing crash-recovery/session-restore functionality. The vendor advisory at https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq confirms both mitigations.