CVE-2026-65612 describes a command injection vulnerability in the nnn file manager due to improper sanitization of the filename variable. An attacker can craft a filename containing a single quote followed by shell syntax and place it on a shared filesystem, removable media, or inside an archive. When the victim previews this file using the preview-tabbed feature, the filename is embedded unsafely into a shell command, resulting in execution of arbitrary commands with the privileges of the nnn process. The vulnerability was confirmed in version 5.2, but no further version range or patch information is available from the maintainer.

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the nnn process when a victim previews a maliciously named file. This can lead to unauthorized command execution and potential system compromise depending on the privileges of the nnn process. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening or previewing files from untrusted sources using the preview-tabbed feature in nnn, especially files from shared filesystems, removable media, or extracted archives with suspicious filenames.