Insecure Temporary File Vulnerability in nnn Affected by pdfread and nuke Plugins

CVE-2026-121549

What is CVE-2026-121549?

The nnn application, specifically versions up to 5.3, contains an insecure temporary file vulnerability in its pdfread and nuke plugins. This flaw allows local attackers to exploit predictable file paths in the /tmp directory. By pre-creating a symbolic link at a name-derived or PID-derived path, an attacker can manipulate the victim's plugin processes to truncate and overwrite arbitrary files that the victim is permitted to access. This poses a significant security risk, enabling unauthorized modifications of critical data.

References