Jarun nnn: OS command injection via togglex plugin (CVE-2026-121548)
The nnn file manager utility contains a command injection vulnerability in the togglex plugin, allowing attackers to execute arbitrary commands through maliciously crafted filenames.
CVE search metadata
CVE search record: CVE-2026-121548. Severity: high. CVSS: 7.8. KEV: no. Product: nnn (<= 5.3). Brief: Jarun nnn: OS command injection via togglex plugin (CVE-2026-121548). Brief link: https://feed.craftedsignal.io/briefs/2026-11-nnn-command-injection/
Triage facts
Revision 1- Applicability
- nnn (<= 5.3)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 20:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The nnn file manager (versions up to and including 5.3) contains an OS command injection vulnerability in the plugins/togglex script. The vulnerability arises because filenames containing double quotes and shell metacharacters are improperly passed to an sh -c script via xargs -I. This allows an attacker to achieve arbitrary code execution under the privileges of the user running the togglex plugin.
Impact
An attacker who can control file names within a directory managed or processed by the togglex plugin can execute arbitrary shell commands with the privileges of the user invoking the utility.
Recommendation
- Upgrade to a patched version of nnn when available or remove the
plugins/togglexscript from the installation directory. - Review directory contents in high-risk areas for filenames containing unusual shell metacharacters (e.g.,
",$,;,&,|,\,`). - Restrict user permissions to write or modify files in directories processed by file management utilities.
Immediate actions
Identify and remove or disable the plugins/togglex script on affected Linux systems
Threat Hunt
Hunt for suspicious file names in directories managed by nnn
Data: File system metadata (find command output)
Mitigations
Remove plugins/togglex script from the nnn plugin directory
CVE-2026-121548