Bug 2565932 (CVE-2026-121548) - CVE-2026-121548 nnn: nnn: Arbitrary command execution via crafted filenames in togglex plugin
Summary: CVE-2026-121548 nnn: nnn: Arbitrary command execution via crafted filenames i...
Keywords:
Status: NEW
Alias: CVE-2026-121548
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2568117 2568118
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-03 16:31 UTC by OSIDB Bzimport
Modified: 2026-11-06 14:00 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-03 16:31:01 UTC 
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.
Note You need to log in before you can comment on or make changes to this bug.