Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121549nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
Medium 4.4
In plain English
A medium-severity security flaw in nnn from jarun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nnn | no fix listed | DEBIAN-CVE-2026-121549 |
| Debian:13 | nnn | no fix listed | DEBIAN-CVE-2026-121549 |
| Debian:14 | nnn | no fix listed | DEBIAN-CVE-2026-121549 |
| Ubuntu:22.04:LTS | nnn | no fix listed | UBUNTU-CVE-2026-121549 |
| Ubuntu:24.04:LTS | nnn | no fix listed | UBUNTU-CVE-2026-121549 |
| Ubuntu:26.04:LTS | nnn | no fix listed | UBUNTU-CVE-2026-121549 |
| Ubuntu:26.10 | nnn | no fix listed | UBUNTU-CVE-2026-121549 |
Affected products (as reported)
Weakness: CWE-377 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
References
- GitHub Issue #2188 issue-tracking
- https://github.com/jarun/nnn product
- Fix commit patch
- https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10 technical-description
- https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280 technical-description
- VulnCheck Advisory: nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins third-party-advisory