CVE-2026-121548 in nnn
Summary
by MITRE • 11/03/2026
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Jarun nnn versions through 5.3 represents a critical OS command injection flaw located within the togglex plugin functionality. This security issue stems from improper neutralization of special elements used in an operating system command, specifically when handling file names passed to external processes. The core technical defect lies in how the application constructs shell commands for execution. When users invoke the togglex feature with files that have been deliberately named to include double quotes and other shell metacharacters, these inputs are not adequately sanitized or escaped before being incorporated into system calls. This lack of input validation allows malicious actors to inject arbitrary command sequences directly into the execution context of the application.
The operational mechanism of this exploit relies on the specific behavior of the xargs utility combined with sh -c scripting. In the affected implementation, file names containing crafted syntax are passed as arguments to xargs using the -I flag for replacement strings. These inputs are then spliced directly into an sh -c command string without proper quoting or escaping mechanisms. Consequently, when the shell interprets this constructed command line, it parses the injected characters not merely as data but as executable instructions. This allows attackers to break out of the intended file operation context and execute arbitrary system commands with the privileges of the user who invoked togglex. The severity is compounded by the fact that no additional authentication or privilege escalation steps are required beyond having access to run nnn, making this a straightforward remote code execution vector if the application is accessible via untrusted input sources such as web interfaces or shared directories.
From an industry standards perspective, this vulnerability aligns with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack pattern corresponds to ATT&CK technique T1059, specifically sub-technique 004 for Unix Shell Commands, where adversaries use shell commands to execute actions on a target system. The exploitation vector is classified under CWE-20, Improper Input Validation, indicating that the software failed to verify or incorrectly verified input data before processing it in a security-critical context. This classification highlights the fundamental failure in defensive coding practices regarding string manipulation and command construction within shell environments.
The impact of this vulnerability extends beyond simple information disclosure. Successful exploitation grants an attacker full control over the underlying operating system processes running under the user account associated with nnn. Depending on the configuration and permissions of that specific user, this could lead to complete compromise of the host machine, including theft of sensitive data, installation of malware, or use of the compromised system as a pivot point for further network attacks. In multi-user environments where shared directories are common, an attacker merely needs to place a maliciously named file in a watched directory to trigger the execution when another user runs nnn and selects that plugin feature.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade to a version of Jarun nnn where this vulnerability has been patched, ensuring that input sanitization routines are properly implemented within the togglex plugin codebase. Developers should enforce strict allow-listing for file name characters or implement rigorous escaping procedures using language-specific libraries designed for safe command construction rather than manual string concatenation. For administrators unable to upgrade immediately, restricting access to nnn and its plugins to trusted users only can reduce exposure. Additionally, running the application with minimal necessary privileges through principle of least privilege models can limit the blast radius if an injection attempt is successful. Regular security audits focusing on external command invocation patterns are recommended to prevent similar vulnerabilities in future updates or custom plugin developments.