Kakoune is a lightweight code editor that includes an autorestore feature enabled by default. The revision prior to 2026.05.21 contains a bug in the bundled autorestore.kak script that allows a malicious backup filename to inject arbitrary shell or kakoune commands. When a user opens a backup file crafted with a specially crafted filename, the script treats the filename as part of a system command and executes it, giving the attacker full remote code execution on the host where Kakoune runs. This is a classic command injection (CWE‑74) combined with a code injection vulnerability (CWE‑94) that can compromise confidentiality, integrity, and availability.

The vulnerability affects the Kakoune code editor from versions before 2026.05.21. Any installation that includes the default autorestore script before this release is susceptible. The vendor "mawww" released a fix in commit 25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825. Users on older releases should check their version and either upgrade or disable the autorestore feature.

The CVSS score is 8.6, indicating high severity, and the EPSS score is 0.00137 (≈0.14%). The vulnerability is not listed in the CISA KEV catalog, but the readiness for exploitation is high because the flaw is triggered simply by opening a crafted backup file—an action that any user capable of running Kakoune can perform. The attack requires the ability to provide a malicious backup file but does not need external network access. Once exploited, the attacker can execute commands with the permissions of the user running Kakoune, leading to potential system compromise.