CVE-2026-48120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48120", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:46:58.290Z", "datePublished": "2026-08-07T22:34:02.607Z", "dateUpdated": "2026-08-11T01:20:08.508Z"}, "containers": {"cna": {"title": "Kakoune has a Critical RCE via Autorestore Backup Filename Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq"}, {"name": "https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825", "tags": ["x_refsource_MISC"], "url": "https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825"}], "affected": [{"vendor": "mawww", "product": "kakoune", "versions": [{"version": "< 2026.05.21", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T22:34:02.607Z"}, "descriptions": [{"lang": "en", "value": "Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature."}], "source": {"advisory": "GHSA-h99r-h8cp-vwcq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T01:19:54.109349Z", "id": "CVE-2026-48120", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:20:08.508Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T01:19:54.109349Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:20:02.589Z"}}], "cna": {"title": "Kakoune has a Critical RCE via Autorestore Backup Filename Injection", "source": {"advisory": "GHSA-h99r-h8cp-vwcq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "mawww", "product": "kakoune", "versions": [{"status": "affected", "version": "< 2026.05.21"}]}], "references": [{"url": "https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq", "name": "https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825", "name": "https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-07T22:34:02.607Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48120", "state": "PUBLISHED", "dateUpdated": "2026-08-11T01:20:08.508Z", "dateReserved": "2026-05-20T18:46:58.290Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-07T22:34:02.607Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kakoune", "vendor": "mawww", "versions": [{"status": "affected", "version": "< 2026.05.21"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature."}, {"lang": "es", "value": "Kakoune es un editor de c\u00f3digo. Antes de la versi\u00f3n 2026.05.21, el script \u2019autorestore.kak\u2019 incluido y habilitado por defecto puede ser explotado por archivos de copia de seguridad maliciosos, lo que lleva a la ejecuci\u00f3n de comandos arbitrarios de kakoune y de shell simplemente abriendo un archivo. Kakoune 2026.05.21 corrige el problema. Como soluci\u00f3n alternativa, a\u00f1adir \u2019autorestore-disable\u2019 al kakrc del usuario deshabilitar\u00e1 la funci\u00f3n de autorestore."}], "id": "CVE-2026-48120", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48120", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T01:19:54.109349Z", "version": "2.0.3"}}]}, "published": "2026-08-07T23:17:04.117", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825"}, {"source": "security-advisories@github.com", "url": "https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "kakoune: Kakoune: Remote Code Execution via malicious backup files", "id": "2512701", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512701"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.", "A flaw was found in Kakoune, a code editor. A local attacker could exploit a vulnerability in the bundled `autorestore.kak` script by crafting malicious backup files. When a user simply opens a file, these malicious backup files can lead to the execution of arbitrary Kakoune and shell commands. This results in remote code execution on the affected system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, disable the `autorestore` feature in Kakoune. This can be achieved by adding `autorestore-disable` to the user's `kakrc` configuration file. Disabling this feature will prevent the automatic restoration of files, which may affect user workflow. A restart of Kakoune is required for the change to take effect."}, "name": "CVE-2026-48120", "public_date": "2026-08-07T22:34:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48120\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48120\nhttps://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825\nhttps://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq"], "statement": "Opening a file in Kakoune triggers the default-enabled `autorestore.kak` script to parse local backup files, which can execute arbitrary Kakoune and shell commands within the user's session context. This vulnerability presents full impact across the CIA triad with complete compromise of Confidentiality, Integrity, and Availability (C:H, I:H, A:H) because the executed commands run with the complete privileges of the user running the editor. Systems are only exposed when opening files from untrusted directories containing attacker-controlled backup files; non-interactive executions, automated scripting environments, or interactive workflows operating strictly in isolated, trusted file systems remain entirely unaffected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.05.21)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "kakoune", "source": "cna", "vendor": "mawww"}, "product": "kakoune", "vendor": "mawww"}], "created": "2026-08-07T23:30:17.649842+00:00", "updated": "2026-08-13T10:15:07.440552+00:00", "vendors": ["mawww", "mawww$PRODUCT$kakoune"]}