Live › vulnerability › CVE-2026-121548
The nnn terminal file manager's togglex plugin passes filenames into a shell script without escaping them. A file whose name contains a double quote and shell syntax can make the plugin run commands as the user who invoked it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Anyone running nnn 5.3 or earlier with the togglex plugin enabled, where files with crafted names may be present in a directory the user opens. Users who do not use the togglex plugin are not described as exposed by the sources. Attackers need to place a file in a directory the user later processes with the plugin.
No product ranges from the sources yet.
nnn -V; versions through 5.3 are listed as affected.5.3, per the linked patch (version number not stated in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.
This page as .md · .json · in your agent: get_signal("CVE-2026-121548")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.