CVE-2026-65611

What it is

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the crafted directory name is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. Limited direct impact.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-08-19 14:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-27 12:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-19 14:17 UTC

Last modified

2026-10-27 12:10 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-78 · OS command injection

Record status

Deferred

Attack profile CVSS 4.0 · 5.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

None

Integrity

Low

Availability

None