Cpe:2.3:a:jarun:nnn:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ajarunnnn/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:01:27 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJarun nnn: OS command injection via togglex plugin (CVE-2026-121548)https://feed.craftedsignal.io/briefs/2026-11-nnn-command-injection/Tue, 03 Nov 2026 20:01:27 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nnn-command-injection/The nnn file manager utility contains a command injection vulnerability in the togglex plugin, allowing attackers to execute arbitrary commands through maliciously crafted filenames.The nnn file manager (versions up to and including 5.3) contains an OS command injection vulnerability in the plugins/togglex script. The vulnerability arises because filenames containing double quotes and shell metacharacters are improperly passed to an sh -c script via xargs -I. This allows an attacker to achieve arbitrary code execution under the privileges of the user running the togglex plugin.

Impact

An attacker who can control file names within a directory managed or processed by the togglex plugin can execute arbitrary shell commands with the privileges of the user invoking the utility.

Recommendation

  • Upgrade to a patched version of nnn when available or remove the plugins/togglex script from the installation directory.
  • Review directory contents in high-risk areas for filenames containing unusual shell metacharacters (e.g., ", $, ;, &, |, \, `).
  • Restrict user permissions to write or modify files in directories processed by file management utilities.
]]>highadvisorycommand-injectionvulnerability