Search
Find a vulnerability
Search criteria
6 vulnerabilities by jarun
CVE-2026-123201 (GCVE-0-2026-123201)
Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-09 17:45
VLAI
EPSS
VEX
Title
buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
Summary
Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:35 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/jarun/buku/issues/910 | issue-tracking |
| https://github.com/jarun/buku/pull/916 | patchissue-tracking |
| https://github.com/jarun/buku/commit/13f6497afc97… | patch |
| https://github.com/jarun/buku/blob/e232ac357cbba2… | technical-description |
| https://github.com/jarun/buku/blob/e232ac357cbba2… | technical-description |
| https://www.vulncheck.com/advisories/buku-through… | third-party-advisory |
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123201",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:35:37.598425Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:45:19.136Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/buku",
"product": "buku",
"repo": "https://github.com/jarun/buku",
"vendor": "jarun",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "LeXofLeviafan"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:37.726Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/buku/issues/910"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/jarun/buku/pull/916"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084"
},
{
"name": "VulnCheck Advisory: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/buku-through-5.1.1-ssrf-via-bukuserver-fetch-data-and-network-handle-api"
}
],
"title": "buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123201",
"datePublished": "2026-11-05T18:16:37.726Z",
"dateReserved": "2026-11-05T17:58:50.301Z",
"dateUpdated": "2026-11-09T17:45:19.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121627 (GCVE-0-2026-121627)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-09 15:26
VLAI
EPSS
VEX
Title
buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
Summary
buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/jarun/buku/issues/911 | issue-tracking |
| https://github.com/jarun/buku/blob/v5.1.1/bukuser… | technical-description |
| https://github.com/jarun/buku | product |
| https://www.vulncheck.com/advisories/buku-5.0-thr… | third-party-advisory |
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121627",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:25:46.592449Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:26:11.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/buku",
"product": "buku",
"vendor": "jarun",
"versions": [
{
"lessThanOrEqual": "5.1.1",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers\u0027 credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:13:53.952Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #911",
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/buku/issues/911"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133"
},
{
"tags": [
"product"
],
"url": "https://github.com/jarun/buku"
},
{
"name": "VulnCheck Advisory: buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/buku-5.0-through-5.1.1-stored-xss-via-bukuserver-bookmark-list-url"
}
],
"title": "buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121627",
"datePublished": "2026-11-03T17:13:53.952Z",
"dateReserved": "2026-11-03T16:57:44.844Z",
"dateUpdated": "2026-11-09T15:26:11.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121550 (GCVE-0-2026-121550)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-09 15:09
VLAI
EPSS
VEX
Title
nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
Summary
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:09 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/jarun/nnn/issues/2188 | issue-tracking |
| https://github.com/jarun/nnn | product |
| https://github.com/jarun/nnn/commit/04715921aece0… | patch |
| https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L10635 | technical-description |
| https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L7433 | technical-description |
| https://www.vulncheck.com/advisories/nnn-through-… | third-party-advisory |
Date Public
2026-10-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:09:26.877097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:09:36.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "nnn",
"vendor": "jarun",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim\u0027s browsed paths."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 1,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:09.442Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2188",
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/nnn/issues/2188"
},
{
"tags": [
"product"
],
"url": "https://github.com/jarun/nnn"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L10635"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L7433"
},
{
"name": "VulnCheck Advisory: nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nnn-through-5.3-symlink-following-write-via-nnn-fifo-handling"
}
],
"title": "nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121550",
"datePublished": "2026-11-03T15:17:09.442Z",
"dateReserved": "2026-11-03T14:46:14.575Z",
"dateUpdated": "2026-11-09T15:09:36.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121549 (GCVE-0-2026-121549)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-07 03:08
VLAI
EPSS
VEX
Title
nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
Summary
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.
Severity
4.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:08 UTC
CWE
- CWE-377 - Insecure Temporary File
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/jarun/nnn/issues/2188 | issue-tracking |
| https://github.com/jarun/nnn | product |
| https://github.com/jarun/nnn/commit/04715921aece0… | patch |
| https://github.com/jarun/nnn/blob/v5.3/plugins/pd… | technical-description |
| https://github.com/jarun/nnn/blob/v5.3/plugins/nu… | technical-description |
| https://www.vulncheck.com/advisories/nnn-through-… | third-party-advisory |
Date Public
2026-10-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121549",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:08:30.473969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:08:53.973Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jarun/nnn/issues/2188"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "nnn",
"vendor": "jarun",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim\u0027s plugin truncates and overwrites any file the victim can write."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-377",
"description": "Insecure Temporary File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:08.749Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2188",
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/nnn/issues/2188"
},
{
"tags": [
"product"
],
"url": "https://github.com/jarun/nnn"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280"
},
{
"name": "VulnCheck Advisory: nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins"
}
],
"title": "nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121549",
"datePublished": "2026-11-03T15:17:08.749Z",
"dateReserved": "2026-11-03T14:46:14.234Z",
"dateUpdated": "2026-11-07T03:08:53.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121548 (GCVE-0-2026-121548)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-03 16:47
VLAI
EPSS
VEX
Title
nnn through 5.3 OS Command Injection via togglex Plugin
Summary
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:45 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/jarun/nnn/issues/2188 | issue-tracking |
| https://github.com/jarun/nnn | product |
| https://github.com/jarun/nnn/commit/04715921aece0… | patch |
| https://github.com/jarun/nnn/blob/v5.3/plugins/to… | technical-description |
| https://www.vulncheck.com/advisories/nnn-through-… | third-party-advisory |
Date Public
2026-10-31 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121548",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:45:48.239137Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:47:00.917Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jarun/nnn/issues/2188"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "nnn",
"vendor": "jarun",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:08.075Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2188",
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/nnn/issues/2188"
},
{
"tags": [
"product"
],
"url": "https://github.com/jarun/nnn"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/togglex#L15"
},
{
"name": "VulnCheck Advisory: nnn through 5.3 OS Command Injection via togglex Plugin",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nnn-through-5.3-os-command-injection-via-togglex-plugin"
}
],
"title": "nnn through 5.3 OS Command Injection via togglex Plugin",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121548",
"datePublished": "2026-11-03T15:17:08.075Z",
"dateReserved": "2026-11-03T14:46:13.918Z",
"dateUpdated": "2026-11-03T16:47:00.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13566 (GCVE-0-2025-13566)
Vulnerability from cvelistv5 – Published: 2025-11-23 19:32 – Updated: 2025-11-24 21:20 X_Open Source
VLAI
EPSS
VEX
Title
jarun nnn nnn.c run_cmd_as_plugin double free
Summary
A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of the file nnn/src/nnn.c. The manipulation leads to double free. An attack has to be approached locally. The identifier of the patch is 2f07ccdf21e705377862e5f9dfa31e1694979ac7. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-24 21:20 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.333330 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.333330 | signaturepermissions-required |
| https://vuldb.com/?submit.698113 | third-party-advisory |
| https://github.com/jarun/nnn/issues/2091#issue-36… | issue-tracking |
| https://github.com/jarun/nnn/issues/2091#issuecom… | issue-tracking |
| https://github.com/jarun/nnn/commit/2f07ccdf21e70… | patch |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13566",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-24T21:20:33.762948Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-24T21:20:43.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "nnn",
"vendor": "jarun",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "affected",
"version": "5.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "micromilo (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in jarun nnn up to 5.1. The impacted element is the function show_content_in_floating_window/run_cmd_as_plugin of the file nnn/src/nnn.c. The manipulation leads to double free. An attack has to be approached locally. The identifier of the patch is 2f07ccdf21e705377862e5f9dfa31e1694979ac7. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "Double Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-23T19:32:07.206Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-333330 | jarun nnn nnn.c run_cmd_as_plugin double free",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.333330"
},
{
"name": "VDB-333330 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.333330"
},
{
"name": "Submit #698113 | nnn v5.1 Double Free",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.698113"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/nnn/issues/2091#issue-3635886658"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jarun/nnn/issues/2091#issuecomment-3547591759"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jarun/nnn/commit/2f07ccdf21e705377862e5f9dfa31e1694979ac7"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2025-11-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-11-22T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-11-22T18:43:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "jarun nnn nnn.c run_cmd_as_plugin double free"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-13566",
"datePublished": "2025-11-23T19:32:07.206Z",
"dateReserved": "2025-11-22T17:37:52.818Z",
"dateUpdated": "2025-11-24T21:20:43.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}