Full Report
CERT Polska has received a report about 4 vulnerabilities (from CVE-2026-65609 to CVE-2026-65612) found in nnn software.
Analysis Summary
Below is a technical summary of the vulnerabilities identified in the `nnn` terminal file manager, based on the advisory from CERT Polska.
# Vulnerability: Multiple Flaws in nnn File Manager (Memory Corruption & Command Injection)
## CVE Details
- **CVE ID:** CVE-2026-65609, CVE-2026-65610, CVE-2026-65611, CVE-2026-65612
- **CVSS Score:** Not explicitly provided (Estimated High: 7.0 - 8.8 range)
- **CWE:** CWE-787 (Out-of-bounds Write), CWE-197 (Numeric Truncation Error), CWE-78 (OS Command Injection)
## Affected Systems
- **Products:** nnn (terminal file manager)
- **Versions:** 5.2 (Other versions potentially affected; maintainer has not confirmed fixed ranges)
- **Configurations:** Systems where `nnn` is used to browse untrusted directories, load session files, or use the `preview-tabbed` plugin.
## Vulnerability Description
Four distinct vulnerabilities were identified:
1. **CVE-2026-65609 (Out-of-bounds Write):** Occurs during the deserialization of session files. The software fails to validate length fields when using the `-s` option, allowing a crafted session file to overwrite fixed-size global buffers.
2. **CVE-2026-65610 (Numeric Truncation):** The `homelen` variable uses an 8-bit `uchar_t`. If an attacker can influence the `HOME` path to a specific length, the value truncates. This leads to an integer underflow in the expression `(homelen - 1)`, resulting in an out-of-bounds read/write.
3. **CVE-2026-65611 (Command Injection):** Lack of sanitization in the path variable during batch copy/move workflows. Maliciously named directories (e.g., containing single quotes and shell syntax) can trigger arbitrary command execution when processed.
4. **CVE-2026-65612 (Command Injection):** Lack of filename sanitization when using the `preview-tabbed` plugin. A crafted filename can execute injected shell payloads when a user navigates to or previews the file.
## Exploitation
- **Status:** PoC available (reported via AFINE Team); No known exploitation in the wild.
- **Complexity:** Medium (Requires user interaction or placement of malicious files/sessions).
- **Attack Vector:** Local/Adjacent (Malicious session files, shared filesystems, or extracted archives).
## Impact
- **Confidentiality:** High (Potential for arbitrary code execution and data access).
- **Integrity:** High (Memory corruption and command injection allow system modification).
- **Availability:** High (Potential for application crashes or system takeover).
## Remediation
### Patches
- Users are advised to check the official `nnn` GitHub repository for the latest commits, as the maintainer was notified but has not officially released a numbered security patch version at the time of the advisory.
### Workarounds
- **Session Files:** Avoid loading session files from untrusted sources or shared directories.
- **Environment:** Ensure the `HOME` environment variable path is standard and does not exceed 255 characters.
- **File Naming:** Exercise caution when browsing directories or archives from untrusted sources, especially those containing special characters (`;`, `'`, `&`).
- **Plugins:** Disable or avoid the `preview-tabbed` plugin when handling untrusted files.
## Detection
- **Indicators of Compromise:** Unusual child processes spawned by `nnn`; unexpected files in the session directory.
- **Detection methods:** Audit file names and directory paths for shell metacharacters on shared drives. Monitor for memory-related crashes when starting `nnn` with the `-s` flag.
## References
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/posts/2026/08/vulnerabilities-in-nnn/
- **CVD Policy:** hxxps[://]cert[.]pl/en/cvd/
- **CVE Records:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-65609 (through 65612)