EUVD-2026-62401
GHSA-mxcx-xvcg-f843
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery via shared filesystem; no attacker privileges required; user interaction mandatory; arbitrary code execution yields full user-level confidentiality, integrity, and availability impact.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process.
Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.
AnalysisAI
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to a directory containing a crafted filename and the preview-tabbed feature is triggered. The unsanitized filename variable is interpolated directly into a generated shell command, enabling any attacker capable of placing a maliciously named file on a shared filesystem, removable media, or inside a delivered archive to execute code with the privileges of the victim's nnn process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the victim is running nnn version 5.2 - other versions are unconfirmed but potentially affected - with the preview-tabbed feature active; (2) the victim navigates to a directory containing a file whose name incorporates a single quote followed by shell metacharacters; and (3) the preview-tabbed feature processes that filename, which may occur automatically on directory navigation or file selection depending on configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 reflects moderate risk driven by mandatory victim interaction (UI:A), which constrains opportunistic, automated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version has been confirmed at time of analysis; the maintainer was notified of CVE-2026-65612 but did not provide a vulnerable version range or fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared fil
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who contr
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session f
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today