{"id":"CVE-2026-48120","title":"Kakoune is a code editor","summary":"Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening …","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwe":["CWE-74"],"published":"2026-08-07","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48120","references":[{"url":"https://github.com/mawww/kakoune/commit/25c7b13b244fd1ddacc63ecfe1784b5ebc2ba825","label":"security-advisories@github.com"},{"url":"https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00137,"epssPercentile":0.03502,"ingestedAt":"2026-09-09T21:22:45.525Z","slug":"CVE-2026-48120","body":"## Overview\n\nKakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}