CVE-2026-121550
Last modified
CVE-2026-121550 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths..
Description
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jarun | nnn | <= 5.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-121550?
How severe is CVE-2026-121550?
How do I fix CVE-2026-121550?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121545Dreeve before 5.8.0 contains a missing authentication vulner…6.5
- CVE-2026-121546ruTorrent before 5.3.20 contains a path traversal vulnerabil…5.9
- CVE-2026-121547Canop dysk before 3.8.2 contains a terminal escape sequence …2.2
- CVE-2026-121548Jarun nnn through 5.3 contains an OS command injection vulne…7.8
- CVE-2026-121549nnn through 5.3 contains an insecure temporary file vulnerab…4.4
- CVE-2026-12155IBM MQ could allow an authenticated attacker to cause a deni…6.5
- CVE-2026-121551PostfixAdmin through 4.0.5 contains a stored cross-site scri…5.4
- CVE-2026-121552Dromara domain-admin before 1.6.79 contains a missing author…4.3
- CVE-2026-121553Cotonti through 1.0.0 generates registration and email-chang…4.8
- CVE-2026-121554cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an…5.9
- CVE-2026-121555Foxel through 2.4.0 contains a missing authentication vulner…7.5
- CVE-2026-121556FastBee through 2.1.0 contains an insecure direct object ref…8.3
Are you affected by CVE-2026-121550?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST