nnn suffers from a command injection vulnerability (CWE-78) due to improper sanitization of the path variable. An attacker can create a directory with a name containing a single quote followed by shell commands on a shared filesystem, removable media, or extracted archive. When a victim navigates into this directory and performs batch copy or move operations, the crafted directory name is embedded into a shell command, leading to execution of the injected payload with the privileges of the nnn process. The vulnerability was confirmed in version 5.2, but no specific affected version range or patch information is provided by the maintainer.

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the nnn process, potentially leading to unauthorized actions on the victim's system. The vulnerability requires user interaction (UI:A) and local access to the filesystem where the malicious directory is created. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid entering directories with suspicious names containing shell syntax when using batch copy or move workflows in nnn. Exercise caution when accessing directories from shared filesystems, removable media, or extracted archives.