CVE-2026-65611: nnn File Manager RCE Vulnerability

CVE-2026-65611 Overview

CVE-2026-65611 is a command injection vulnerability in the nnn terminal file manager. The flaw exists because nnn does not sanitize the path variable before embedding it into shell commands generated by the batch copy or move workflow. An attacker can craft a directory whose name contains a single quote followed by shell syntax. When a victim enters the directory and triggers the batch operation, the injected payload executes with the privileges of the nnn process. Version 5.2 was confirmed vulnerable. The maintainer was notified but did not provide a vulnerable version range.

Critical Impact
Arbitrary command execution in the context of the nnn user when a victim navigates into an attacker-controlled directory and initiates a batch file operation.

Affected Products

nnn file manager, version 5.2 (confirmed)
Additional versions may be affected; the maintainer did not publish a vulnerable version range
Systems that mount shared filesystems, removable media, or extract archives from untrusted sources

Discovery Timeline

2026-08-19 - CVE-2026-65611 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-65611

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. The nnn file manager constructs shell commands for its batch copy and move workflow using file and directory names taken directly from the filesystem. Because the path variable is not sanitized or safely quoted, a directory name that contains a single quote can terminate the intended string literal and append arbitrary shell syntax. The injected content is then interpreted by the shell rather than treated as a filename.

Exploitation requires user interaction. The victim must navigate into the attacker-controlled directory and invoke the batch copy or move workflow inside nnn. Once triggered, the injected commands run with the privileges of the local user session running nnn.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command. Filenames on Unix-like systems may contain single quotes and other shell metacharacters. nnn embeds these values into a generated shell string without escaping the single quote character, breaking out of the quoted context.

Attack Vector

An attacker delivers the malicious directory through any shared or extractable medium. Realistic vectors include a network-mounted filesystem, a USB drive, a downloaded archive that is unpacked locally, or a synchronized cloud folder. The attack succeeds only when the victim opens the directory in nnn and starts the batch copy or move operation.

The vulnerability is described in the CERT Polska advisory. See the CERT Polska CVE-2026-65609 Post for technical details.

Detection Methods for CVE-2026-65611

Indicators of Compromise

Directory entries containing single-quote characters followed by shell metacharacters such as ;, &&, |, or $(
Unexpected child processes spawned by the nnn binary, especially sh, bash, curl, wget, or nc
Files or directories created on removable media or shared mounts with suspicious names embedding shell syntax

Detection Strategies

Monitor process execution telemetry for nnn spawning shells or network utilities outside routine workflows
Inspect filesystem scan results for filenames that contain quote characters combined with command separators
Correlate archive extraction events with subsequent shell activity under the same user session

Monitoring Recommendations

Audit user home directories, mounted shares, and extraction targets for filenames containing shell metacharacters
Log command lines of processes launched by interactive file managers on multi-user or shared systems
Alert on execution of nnn batch operations against paths originating from removable or network media

How to Mitigate CVE-2026-65611

Immediate Actions Required

Avoid using the batch copy and move workflow in nnn on directories sourced from untrusted media until a fixed release is confirmed
Inspect directory names before entering them in nnn, particularly on shared or removable filesystems
Restrict mounting of untrusted removable media on systems where nnn is used interactively

Patch Information

The maintainer was notified of the issue. A specific patched version has not been documented in the advisory, and no vulnerable version range was provided. Users should track the upstream nnn repository for a fix and upgrade once a corrected release is published. Only version 5.2 has been explicitly confirmed as vulnerable.

Workarounds

Extract untrusted archives into an isolated location and review contents with a tool that does not invoke shell interpolation before browsing them in nnn
Disable or avoid the batch copy and move features when working across untrusted paths
Rename directories that contain single quotes or other shell metacharacters before operating on them with nnn

bash

# Identify directory names that could trigger the injection before using nnn batch operations
find /mnt/untrusted -type d -name "*'*" -print