CVE-2026-48120

Received Received - Intake

Code Execution via Malicious Backup in Kakoune Editor

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-48120

Affected Vendors & Products

Vendor	Product	Version / Range
kakoune	kakoune	to 2026.05.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

The vulnerability in Kakoune before version 2026.05.21 involves the autorestore.kak script which can be exploited by malicious backup files. Opening such a file allows arbitrary Kakoune and shell commands to be executed without user interaction.

Detection Guidance

To detect this vulnerability, check if you are running Kakoune versions prior to 2026.05.21. Run `kak --version` to see the installed version. If the version is older, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary commands on your system if you open a specially crafted backup file. This may lead to unauthorized access, data theft, or system compromise depending on the executed commands.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could violate compliance requirements under GDPR, HIPAA, or other regulations depending on the data processed.

Mitigation Strategies

Upgrade Kakoune to version 2026.05.21 or later. As a temporary workaround, add `autorestore-disable` to your kakrc file to disable the autorestore feature.

Hi! I’m here to help you understand CVE-2026-48120. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70