CVE-2026-121550: falha de baixa gravidade em jarun nnn
nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 1epss 0.1%
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
jarun · nnnCVEs relacionadas — jarun nnn
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/jarun/nnnhttps://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L10635https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L7433https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efffhttps://github.com/jarun/nnn/issues/2188https://www.vulncheck.com/advisories/nnn-through-5.3-symlink-following-write-via-nnn-fifo-handling