EUVD-2026-62400
GHSA-p5rm-3fq7-7mvj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because directory delivered via network share or archive; UI:R mandatory for batch workflow; S:U since execution stays within victim user privileges; no confidentiality or availability impact confirmed.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the crafted directory name is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
AnalysisAI
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared filesystem, removable media, or inside an extracted archive to execute arbitrary shell commands with the privileges of the nnn process. The unsanitized path variable is embedded directly into shell commands generated by nnn's batch copy and move workflows, enabling a single-quote escape followed by shell metacharacters in a directory name to break out of the intended string context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must be satisfied simultaneously for exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A accurately reflects the moderate but bounded real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version has been identified at time of analysis - the maintainer was notified but did not provide a confirmed fix version or vulnerable version range. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who contr
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session f
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today