nnn fails to escape the user‑controlled path variable, allowing an attacker to create a directory whose name contains a single quote and shell syntax. When that directory name is used in nnn's batch copy or move workflow, the path is inserted directly into a generated shell command, causing the injected payload to run with the privileges of the nnn process. This flaw provides a command injection vector that can result in arbitrary code execution on the host system.

The vulnerability affects the open‑source file manager nnn, specifically version 5.2 which has been confirmed to be vulnerable. No explicit vulnerable‑version range was documented by the maintainer, but any build that includes the unpatched path handling logic is at risk. The flaw can be triggered when the application operates on directories on shared filesystems, removable media, or inside a decompressed archive.

The CVSS score of 5.1 indicates a medium severity. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. However, the attack requires the victim to use the affected workflow with a crafted directory; the consequences are local execution but could be leveraged for privilege escalation if the nnn process runs with elevated rights. The lack of an official fix can be inferred because the maintainer did not supply a vulnerable version range, meaning the risk remains until a patched release is deployed.