Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121548nnn through 5.3 OS Command Injection via togglex Plugin
High 7.8
In plain English
A high-severity OS command injection in nnn from jarun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.2%top 32.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | nnn | no fix listed | UBUNTU-CVE-2026-121548 |
| Ubuntu:24.04:LTS | nnn | no fix listed | UBUNTU-CVE-2026-121548 |
| Ubuntu:26.04:LTS | nnn | no fix listed | UBUNTU-CVE-2026-121548 |
| Ubuntu:26.10 | nnn | no fix listed | UBUNTU-CVE-2026-121548 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Issue #2188 issue-tracking
- https://github.com/jarun/nnn product
- Fix commit patch
- https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15 technical-description
- VulnCheck Advisory: nnn through 5.3 OS Command Injection via togglex Plugin third-party-advisory