Medium severity4.4NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026
CVE-2026-121549
CVE-2026-121549
Description
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/jarun/nnn/blob/v5.3/plugins/nukenvd
- github.com/jarun/nnn/blob/v5.3/plugins/pdfreadnvd
- github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efffnvd
- github.com/jarun/nnn/issues/2188nvd
- www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-pluginsnvd
News mentions
0No linked articles in our index yet.