Is CVE-2026-121548 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121548?

CVE-2026-121548 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-121548

Description

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.