---
id: CVE-2026-121550
title: nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
summary: >-
  nnn through 5.3 contains an insecure file handling vulnerability that allows
  local attackers to redirect writes because main() accepts an existing NNN_FIFO
  path without verifying it is a FIFO. Attackers can pre-create the documented
  pred…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-59
vendor: jarun
product: nnn
affected:
  - nnn <= 5.3
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T15:17:09.442Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121550'
references:
  - url: 'https://github.com/jarun/nnn/issues/2188'
    label: 'GitHub Issue #2188'
  - url: 'https://github.com/jarun/nnn'
  - url: >-
      https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff
    label: Fix commit
  - url: 'https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L10635'
  - url: 'https://github.com/jarun/nnn/blob/v5.3/src/nnn.c#L7433'
  - url: >-
      https://www.vulncheck.com/advisories/nnn-through-5.3-symlink-following-write-via-nnn-fifo-handling
    label: >-
      VulnCheck Advisory: nnn through 5.3 Symlink-Following Write via NNN_FIFO
      Handling
tags:
  - cve.org
epss: 0.00116
epssPercentile: 0.01619
ingestedAt: '2026-11-05T19:30:42.975Z'
---

## Overview

nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.

## Affected

- `nnn <= 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.