Insecure File Handling in nnn by jarun
CVE-2026-121550

1LOW

Key Information:

Vendor

Jarun

Status
Nnn
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121550?

The software nnn up to version 5.3 contains a security flaw related to insecure file handling. The main function improperly accepts a specified NNN_FIFO path without sufficient validation, enabling local attackers to manipulate this path. This allows them to prepare a predictable file at /tmp/nnn.fifo as a symlink or regular file, leading to unauthorized write operations. Victims may unknowingly overwrite their files or expose sensitive browsing paths, compromising the integrity and confidentiality of user data.

Affected Version(s)

nnn 0 <= 5.3

References

https://github.com/jarun/nnn/issues/2188
issue-tracking
https://github.com/jarun/nnn
product
https://github.com/jarun/nnn/commit/04715921aece0257fef7a...
patch

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.