nnn EUVD-2026-115893

Requires (1) an attacker able to place or deliver a file whose name contains a double quote plus shell metacharacters into a directory the victim will open in nnn (e.g. a shared directory, a downloaded or extracted archive, or any directory populated with attacker-influenced filenames), and (2) the victim actively invoking the togglex plugin on a selection that includes that file. Execution runs with the privileges of the user invoking togglex. Limiting factors: the vector is local (AV:L) and strictly requires victim interaction (UI:A) - it does not fire merely from listing the directory, only from running togglex; it affects nnn versions through 5.3 where the unpatched togglex plugin is used. There is no remote or unauthenticated path.

The input CVSS 4.0 score of 8.4 (High) reflects the full compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H) that arbitrary command execution grants, but the vector itself tempers the urgency: AV:L means this is a local, file-based vector rather than remote, and UI:A (active user interaction) means the victim must themselves invoke the togglex plugin on a selection that includes the malicious file - the attacker only plants a filename. PR:N is justified in the sense that placing a file requires no privileges on the target, but execution is gated entirely on victim action. No EPSS score and no KEV listing are present in the supplied data, and there is no SSVC exploitation/automatable breakdown; the only decision signal is vuln.today's 'this_week' priority label, which argues for prompt but not emergency patching. On balance this is a legitimately high-impact but conditional issue - dangerous in multi-user hosts, shared directories, or when browsing extracted/downloaded archives, and lower-risk for a single-user operator browsing only their own trusted files. It is not a mass-exploitable remote vulnerability, so real-world priority should track exposure to untrusted filenames rather than the raw 8.4.

An attacker plants a file whose name contains a double quote and shell syntax into a directory the victim will browse (e.g. a shared folder, an extracted archive, or a web/download directory). When the victim opens that directory in nnn and runs the togglex plugin to flip the executable bit on a selection containing the file, xargs -I splices the crafted name into the sh -c script and the embedded commands run with the victim's privileges. A public VulnCheck advisory and a GitHub issue reference exist; neither is verified as working exploit code in the supplied data.