CVE-2026-121549

Medium

Description

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

SeverityMedium

CVSS4.4

Exploit probability—

ProductJarun Nnn

PublishedNov 3, 2026

First seenNov 4, 2026

Weakness typeCWE-377CWE-377

How to fix

Patches

github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff

Affected products

Product	Affected versions	Fixed in
jarun nnn	v ≤ 5.3	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.