CVE-2026-65611

Name of the Vulnerable Software and Affected Versions nnn version 5.2

Description The software fails to sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or within an extracted archive using a name that contains a single quote followed by shell syntax. When a user enters this directory and utilizes the batch copy or move workflow, the crafted directory name is embedded into the generated shell command, allowing the injected payload to execute with the privileges of the process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.