CVE-2026-121548— nnn through 5.3 OS Command Injection via togglex Plugin

Quick assessment

Affected

jarun nnn

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jarun 从 nnn 版本到 5.3 版本中，其插件存在操作系统命令注入漏洞。攻击者可通过构造特定的文件名来执行任意命令。具体而言，攻击者可创建包含双引号及 Shell 语法的文件名；当将这些文件名拼接至脚本时，会导致以调用的用户身份执行恶意命令。

CVSS 7.8 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1059.004 · Unix Shell

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

nnn through 5.3 OS Command Injection via togglex Plugin

Source: CVE Program / CVE List V5

Vulnerability Description

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
jarun	nnn	0 ~ 5.3	-

II. Public POCs for CVE-2026-121548

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121548

请登录查看更多情报信息。

Other References for CVE-2026-121548 (5)

https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15 technical-description
https://github.com/jarun/nnn product
https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff patch
https://github.com/jarun/nnn/issues/2188 issue-tracking
https://www.vulncheck.com/advisories/nnn-through-5.3-os-command-injection-via-togglex-plugin third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121548

Same Patch Batch · jarun · 2026-11-03 · 4 CVEs total

CVE-2026-121627	6.1 MEDIUM	buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
CVE-2026-121549	4.4 MEDIUM	nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
CVE-2026-121550	3.3 LOW	nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling

IV. Related Vulnerabilities

Same product: nnn

Same vendor: jarun

Same weakness: CWE-78