CVE-2026-65612 Overview
CVE-2026-65612 is a command injection vulnerability in nnn, a terminal file manager. The flaw stems from the application failing to sanitize filenames before embedding them into shell commands generated by the preview-tabbed plugin. An attacker who plants a file with a crafted name containing a single quote followed by shell syntax can trigger arbitrary command execution when the victim previews the file. The injected payload runs with the privileges of the nnn process. Version 5.2 has been tested and confirmed vulnerable. The vulnerability is classified under [CWE-78] (OS Command Injection).
Critical Impact
Arbitrary shell command execution occurs when a user previews a maliciously named file, granting the attacker the privileges of the local nnn process.
Affected Products
- nnn file manager version 5.2 (confirmed vulnerable)
- nnnpreview-tabbed plugin
- Earlier versions may also be affected; the maintainer did not publish a vulnerable version range
Discovery Timeline
- 2026-08-19 - CVE-2026-65612 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-65612
Vulnerability Analysis
The vulnerability resides in the preview-tabbed plugin shipped with nnn. When a user opens a file for preview, the plugin constructs a shell command that references the selected filename. Because the filename is not sanitized or safely quoted, shell metacharacters embedded in the name are interpreted by the shell rather than treated as literal data.
A filename containing a single quote breaks out of the enclosing quoted string in the generated command. Any shell syntax that follows the quote is then parsed and executed. The injected payload runs in the context of the nnn user, which typically corresponds to an interactive desktop session.
Exploitation requires user interaction. The victim must navigate to the malicious file and invoke preview. Delivery vectors include shared filesystems, USB drives, network mounts, and archive extraction. Filenames in extracted archives are a particularly effective vector because users often browse archive contents without inspecting each name. See the CERT Security Advisory for additional technical context.
Root Cause
The root cause is missing input sanitization on the filename variable before its inclusion in a shell command string. The plugin relies on shell interpolation without escaping or using safe argument-passing mechanisms such as execve-style arrays.
Attack Vector
An attacker places a file whose name contains a single quote followed by arbitrary shell syntax onto media the victim can browse. When the victim highlights the file and triggers preview-tabbed, the command is assembled and executed by the shell, running the attacker payload.
No verified public exploit code is available. See the CERT Security Advisory for the vulnerability description.
Detection Methods for CVE-2026-65612
Indicators of Compromise
- Files on shared media or in archives with names containing single quotes and shell metacharacters such as ;, &&, |, or $( ).
- Unexpected child processes spawned by nnn or its preview-tabbed plugin.
- Outbound network connections initiated by shells launched from nnn sessions.
Detection Strategies
- Alert on process trees where nnn or preview-tabbed is the parent of shells executing suspicious commands such as curl, wget, nc, or bash -c.
- Inspect filesystem events for file creation where names contain single quotes and shell control characters.
- Correlate archive extraction events with subsequent execution of shells parented to nnn.
Monitoring Recommendations
- Log and review command-line arguments for any shell invoked as a child of nnn.
- Monitor removable media mounts and network share access followed by file manager activity.
- Retain filename metadata for files sourced from untrusted archives to support forensic review.
How to Mitigate CVE-2026-65612
Immediate Actions Required
- Avoid using the preview-tabbed plugin on files sourced from untrusted media, network shares, or extracted archives.
- Inspect filenames for shell metacharacters before browsing untrusted directories with nnn.
- Run nnn under a least-privileged account to limit the impact of command execution.
Patch Information
The maintainer was notified of the vulnerability. A definitive vulnerable version range and patched release have not been published in the referenced advisory. Users should track the upstream nnn repository for a fixed release and apply it once available. Refer to the CERT Security Advisory for the latest status.
Workarounds
- Disable or remove the preview-tabbed plugin until a patched release is confirmed.
- Rename or reject files whose names contain single quotes or other shell metacharacters before opening them in nnn.
- Extract archives from untrusted sources inside sandboxes or containers that block outbound network access and restrict filesystem write scope.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
