CVE-2026-65612

Name of the Vulnerable Software and Affected Versions nnn version 5.2

Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote followed by shell syntax and a victim opens it using preview-tabbed, the filename is embedded into a generated shell command, allowing the injected payload to execute with the privileges of the nnn process.

Recommendations As a temporary workaround, avoid opening files from untrusted sources using preview-tabbed in nnn version 5.2. At the moment, there is no information about a newer version that contains a fix for this vulnerability.