Extract an archive, browse into it, copy a couple of files, and you have run somebody else's shell command. That is the shape of two of four vulnerabilities CERT Polska disclosed on 19 August in nnn, a widely used terminal file manager, after coordinating the report with the researchers who found them.
The report credits Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team. No CVSS scores are published for any of the four, so severity has to be read off the mechanics rather than a number.
The file name is the payload
The two command injection issues, CVE-2026-65611 and CVE-2026-65612, share a root cause: nnn does not sanitize names before embedding them in the shell commands it generates. In the first, an attacker creates a directory whose name contains a single quote followed by shell syntax, on a shared filesystem, on removable media, or inside an archive the victim will extract. If the victim enters that directory and uses the batch copy or move workflow, the crafted name lands inside the generated command and the injected code runs with the privileges of the nnn process. The second is the same trick applied to a file name, triggered when the victim opens the file with preview-tabbed.
Neither requires the victim to do anything unusual. Browsing into a directory and copying files is the entire purpose of the tool, which is what makes name-based injection in a file manager worse than it sounds. The pattern of untrusted input reaching a shell is the same class of failure IntelFusions covered when command injection flaws exposed Siemens network management servers, and it is unusually cheap to exploit here because the delivery vehicle is a file name on a USB stick.
Two memory bugs on the way in
The other two are memory-safety issues. CVE-2026-65609 is an out-of-bounds write: nnn does not validate attacker-controlled length fields deserialized from a session file, so a crafted session file loaded with the -s option can write past fixed-size global buffers and corrupt neighbouring global variables. Exploiting it requires the attacker to place the malicious session file in the victim's nnn session directory.
CVE-2026-65610 is a numeric truncation error. nnn stores the homelen variable as an unsigned char, which tops out at 255. An attacker who can influence the victim's environment can supply a HOME path whose length truncates to zero, at which point the expression homelen minus one is promoted to a signed integer and becomes -1, producing an out-of-bounds read and a one-byte out-of-bounds write just before the path buffer.
There is no version number to upgrade to
This is the awkward part. CERT Polska says the maintainer was notified and that the issues might have been addressed, but that no vulnerable version range was supplied. Only version 5.2 was tested and confirmed vulnerable, which means there is no clean advice to give beyond checking the project's own release notes and issue tracker for a fix before assuming one exists.
No workarounds are published either, though the preconditions narrow the exposure usefully. All four require attacker-controlled input reaching the tool: a name on a shared filesystem, removable media or an extracted archive for the injections, a planted session file for the out-of-bounds write, and a manipulated environment for the truncation bug. Until a fixed release is confirmed, the practical mitigation is to treat batch copy, move and preview-tabbed as operations to avoid inside directories you did not create yourself. The advisory, including the CWE classifications for each issue, is on CERT Polska's site, and the team's coordinated disclosure process is documented at hxxps://cert[.]pl/en/cvd/. It is a small piece of software and a quiet advisory, but it is a reminder that a file manager parses attacker-controlled text all day, and Poland's national CERT is one of the few doing this coordination work in public.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.