Kakoune
Monthly
Command injection via unsanitized backup filenames in Kakoune (all versions prior to 2026.05.21) enables arbitrary Kakoune script and shell command execution when a victim opens a file in the editor. The bundled `autorestore.kak` script - enabled by default - discovers backup files by pattern-matching filenames in the same directory as the opened file, then incorporates those filenames directly into shell command strings without validating special characters in the suffix component. No public standalone exploit has been identified at time of analysis, though the fix commit (25c7b13) includes test cases that explicitly demonstrate the injection pattern using filenames such as `.out.kak.;"foo"`, confirming exploitability.
Command injection via unsanitized backup filenames in Kakoune (all versions prior to 2026.05.21) enables arbitrary Kakoune script and shell command execution when a victim opens a file in the editor. The bundled `autorestore.kak` script - enabled by default - discovers backup files by pattern-matching filenames in the same directory as the opened file, then incorporates those filenames directly into shell command strings without validating special characters in the suffix component. No public standalone exploit has been identified at time of analysis, though the fix commit (25c7b13) includes test cases that explicitly demonstrate the injection pattern using filenames such as `.out.kak.;"foo"`, confirming exploitability.