CVE-2025-13566mediumCWE-119CWE-415

CVE-2025-13566: medium-severity vulnerability in jarun nnn

jarun nnn nnn.c run_cmd_as_plugin double free

Published · Updated

Follow this CVE+ Monitor nnn

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.1%
A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of the file nnn/src/nnn.c. The manipulation leads to double free. An attack has to be approached locally. The identifier of the patch is 2f07ccdf21e705377862e5f9dfa31e1694979ac7. It is suggested to install a patch to address this issue.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
jarun · nnn
Related CVEs — jarun nnn

In the same product, most dangerous first.

CVE-2026-121548HIGHnnn through 5.3 OS Command Injection via togglex PluginEPSS 1.2%CVE-2026-121550LOWnnn through 5.3 Symlink-Following Write via NNN_FIFO HandlingEPSS 0.1%CVE-2026-121549MEDIUMnnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke PluginsEPSS 0.1%