An attacker can craft a file name containing a single quote followed by shell syntax and place it on a shared filesystem, removable media, or inside an extracted archive. When the victim navigates to that file and opens it with preview‑tabbed, nnn embeds the filename into a shell command and executes it with the privileges of the nnn process. Because the input is not sanitized, the attacker can run arbitrary commands as the nnn user, compromising confidentiality, integrity, and availability of the system on which nnn runs.

The vulnerability affects the nnn file manager. The only version confirmed as vulnerable is 5.2; no vulnerable version range has been supplied by the maintainer. Users running nnn 5.2 or any unpatched versions should verify their installation and consider upgrading if a fix becomes available.

The CVSS score of 5.1 places this flaw in the moderate range, and the EPSS score is < 1%, while it is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can place a crafted file name on a filesystem that the victim can access, such as a shared network share or a removable disk. Once the victim opens the file with preview‑tabbed, the command injection is executed, giving the attacker the same privileges as the nnn process. The risk is limited to systems where nnn is installed and the attacker can influence the file location; nevertheless, it provides a clear pathway to command execution.