CVE-2026-48120: Kakoune Code Editor RCE Vulnerability

CVE-2026-48120 Overview

CVE-2026-48120 is a command injection vulnerability in Kakoune, an interactive code editor. The flaw resides in the autorestore.kak script, which is bundled and enabled by default. A malicious backup file placed adjacent to a target file can trigger arbitrary Kakoune and shell command execution when a user opens the target file in the editor. The issue stems from improper escaping of filenames passed to shell commands within the autorestore logic. Kakoune version 2026.05.21 remediates the vulnerability. This weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Opening a file in a directory that contains an attacker-controlled backup file results in arbitrary shell command execution under the user's privileges.

Affected Products

Kakoune code editor versions prior to 2026.05.21
Installations with the default autorestore.kak script enabled
Any system where a user opens files in attacker-writable directories

Discovery Timeline

2026-08-07 - CVE-2026-48120 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48120

Vulnerability Analysis

The autorestore.kak script automatically restores buffer contents from backup files created with a predictable naming convention: .<basename>.kak.<suffix>. When Kakoune opens a file, the script enumerates matching backup files in the same directory and interpolates their paths into shell command strings without adequate quoting. An attacker who can write files to a directory a victim later opens can craft a backup filename containing shell metacharacters. The metacharacters break out of the intended command context and execute arbitrary commands within the Kakoune shell evaluation block.

Root Cause

The root cause is unsafe string interpolation of untrusted filenames into printf and shell command constructs inside evaluate-commands %sh{ ... } blocks. Filenames returned by find and ls were embedded directly into generated Kakoune commands, allowing single quotes and other special characters in adversary-controlled filenames to close the surrounding quote context and inject additional commands.

Attack Vector

Exploitation requires local access to a directory the target user opens and user interaction to open a file in that directory. The scope is changed because injected commands run in the editor's shell context, extending impact beyond the editor process. Delivery vectors include shared network mounts, extracted archives, cloned repositories containing hidden files, and multi-user systems.

text

     evaluate-commands %sh{
         buffer_basename="${kak_buffile##*/}"
         buffer_dirname=$(dirname "${kak_buffile}")
+        backup_prefix="${buffer_dirname}"/".${buffer_basename}.kak."

         if [ -f "${kak_buffile}" ]; then
-            newer=$(find "${buffer_dirname}"/".${buffer_basename}.kak."* -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
-            older=$(find "${buffer_dirname}"/".${buffer_basename}.kak."* \! -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
+            newer=$(find "${backup_prefix}"* -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
+            older=$(find "${backup_prefix}"* \! -newer "${kak_buffile}" -exec ls -1t {} + 2>/dev/null | head -n 1)
         else
             # New buffers that were never written to disk.
-            newer=$(ls -1t "${buffer_dirname}"/".${buffer_basename}.kak."* 2>/dev/null | head -n 1)
+            newer=$(ls -1t "${backup_prefix}"* 2>/dev/null | head -n 1)
             older=""
         fi

         if [ -z "${newer}" ]; then
             if [ -n "${older}" ]; then
-                printf %s\\n "
-                    echo -debug Old backup file(s) found: will not restore ${older} .
-                "
+                printf "echo -debug 'Old backup file(s) found: will not restore %s.'" "$(printf %s "${older}" | sed s/\'/\'\'/g)"
             fi
             exit
         fi

+        # ensure backup suffix only contains portable filename characters
+        if ! pathchk -p "$(printf %s "${newer}" | cut -b ${#backup_prefix}-)" >/dev/null 2>&1; then
+            printf "echo -debug 'backup file suffix contains unexpected characters %s, ignored.'" "$(printf %s "${newer}" | sed s/\'/\'\'/g)"

Source: GitHub Commit 25c7b13. The patch adds single-quote escaping via sed, validates that the backup suffix contains only portable filename characters using pathchk, and quotes the interpolated filename inside a properly delimited printf format string.

Detection Methods for CVE-2026-48120

Indicators of Compromise

Hidden files matching the pattern .<filename>.kak.<suffix> where the suffix contains shell metacharacters such as single quotes, semicolons, backticks, or $(...) sequences
Unexpected child processes spawned by the kak binary shortly after a file open event
New backup files appearing in shared directories, network mounts, or extracted archives

Detection Strategies

Hunt for kak processes with unusual child processes such as sh, bash, curl, wget, or scripting interpreters invoked without direct user action
Alert on filesystem writes creating hidden files that match the Kakoune backup naming pattern with non-alphanumeric suffix characters
Correlate file-open telemetry with subsequent outbound network connections initiated by editor descendant processes

Monitoring Recommendations

Log execve events on developer workstations and inspect command lines for shell metacharacters originating from editor sessions
Track Kakoune version deployments across managed endpoints to identify hosts still running versions prior to 2026.05.21
Monitor shared repositories and multi-user directories for suspicious dotfiles introduced by non-owners

How to Mitigate CVE-2026-48120

Immediate Actions Required

Upgrade Kakoune to version 2026.05.21 or later on all systems where the editor is installed
Disable the autorestore feature on unpatched systems by adding autorestore-disable to the user kakrc configuration file
Audit directories previously opened with Kakoune for unexpected .kak.<suffix> backup files and remove suspicious entries

Patch Information

The upstream fix is applied in commit 25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825 and shipped in Kakoune 2026.05.21. Additional detail is available in the GitHub Security Advisory GHSA-h99r-h8cp-vwcq and the patch commit.

Workarounds

Add autorestore-disable to ~/.config/kak/kakrc to disable the vulnerable autorestore feature entirely
Avoid opening files from untrusted directories, shared mounts, or freshly extracted archives until systems are patched
Restrict write permissions on directories accessed by Kakoune users to prevent hostile placement of backup files

bash

# Configuration example: disable autorestore on unpatched systems
echo 'autorestore-disable' >> ~/.config/kak/kakrc

# Verify installed version meets or exceeds the fixed release
kak -version