Nnn
Monthly
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to a directory containing a crafted filename and the preview-tabbed feature is triggered. The unsanitized filename variable is interpolated directly into a generated shell command, enabling any attacker capable of placing a maliciously named file on a shared filesystem, removable media, or inside a delivered archive to execute code with the privileges of the victim's nnn process. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the realistic social-engineering delivery path against developer and power-user workstations - populations that routinely extract archives and browse shared mounts - makes it operationally relevant despite the moderate CVSS score.
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared filesystem, removable media, or inside an extracted archive to execute arbitrary shell commands with the privileges of the nnn process. The unsanitized path variable is embedded directly into shell commands generated by nnn's batch copy and move workflows, enabling a single-quote escape followed by shell metacharacters in a directory name to break out of the intended string context. No public exploit has been identified at time of analysis, but exploitation requires only that the victim navigate into the crafted directory and initiate a batch copy or move operation.
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who controls the victim's HOME environment variable to trigger an out-of-bounds read and write. By supplying a HOME path longer than 255 characters, the uchar_t homelen variable wraps to zero; the expression (homelen - 1) promotes to signed int as -1, indexing one byte before the intended path buffer. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects the constrained attack conditions requiring local access and active user interaction.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to a directory containing a crafted filename and the preview-tabbed feature is triggered. The unsanitized filename variable is interpolated directly into a generated shell command, enabling any attacker capable of placing a maliciously named file on a shared filesystem, removable media, or inside a delivered archive to execute code with the privileges of the victim's nnn process. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the realistic social-engineering delivery path against developer and power-user workstations - populations that routinely extract archives and browse shared mounts - makes it operationally relevant despite the moderate CVSS score.
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared filesystem, removable media, or inside an extracted archive to execute arbitrary shell commands with the privileges of the nnn process. The unsanitized path variable is embedded directly into shell commands generated by nnn's batch copy and move workflows, enabling a single-quote escape followed by shell metacharacters in a directory name to break out of the intended string context. No public exploit has been identified at time of analysis, but exploitation requires only that the victim navigate into the crafted directory and initiate a batch copy or move operation.
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who controls the victim's HOME environment variable to trigger an out-of-bounds read and write. By supplying a HOME path longer than 255 characters, the uchar_t homelen variable wraps to zero; the expression (homelen - 1) promotes to signed int as -1, indexing one byte before the intended path buffer. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 2.4 reflects the constrained attack conditions requiring local access and active user interaction.
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session file in the victim's session directory to corrupt adjacent global state when the victim loads the file using the -s option. The vulnerability stems from missing validation of attacker-controlled length fields during session file deserialization, enabling writes beyond fixed-size global buffers. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; the overall risk is low given the local, user-interaction-dependent attack path.