CVE-2026-48120
Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
- Record
CVE-2026-48120- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2026-54719
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
- Record
EUVD-2026-54719- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
- Record
CVE-2026-48120- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
- Record
CVE-2026-48120- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-48120
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
- Record
DEBIAN-CVE-2026-48120- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-48120
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
- Record
UBUNTU-CVE-2026-48120- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kakouneDebian:12 |
All versions, plus listed versions 2022.10.31-12022.10.31-22024.05.18-12024.05.18-22026.05.21-12026.05.21-2 |
None known |
kakouneDebian:13 |
All versions, plus listed versions 2024.05.18-22026.05.21-12026.05.21-2 |
None known |
kakouneDebian:14 |
before 2026.05.21-1, plus listed versions 2024.05.18-2 |
2026.05.21-1 |
kakouneUbuntu:18.04:LTS |
All versions, plus listed versions 0~2016.12.20.1.3a6167ae-10~2016.12.20.1.3a6167ae-1build1 |
None known |
kakouneUbuntu:20.04:LTS |
All versions, plus listed versions 2019.01.20-22019.07.01-12019.07.01-1build1 |
None known |
kakouneUbuntu:22.04:LTS |
All versions, plus listed versions 2020.01.16-32020.09.01-3 |
None known |
kakouneUbuntu:24.04:LTS |
All versions, plus listed versions 2022.10.31-2 |
None known |
kakouneUbuntu:26.10 |
All versions, plus listed versions 2024.05.18-2ubuntu22026.05.21-1ubuntu1 |
None known |
kakouneUbuntu:26.04:LTS |
All versions, plus listed versions 2024.05.18-2ubuntu12024.05.18-2ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-48120 is a high vulnerability (CVSS 8.6) in Mawww Kakoune, published August 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in kakoune 2026.05.21-1.
References
github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq
nvd.nist.gov/vuln/detail/CVE-2026-48120
security-tracker.debian.org/tracker/CVE-2026-48120
ubuntu.com/security/CVE-2026-48120
cve.org/CVERecord?id=CVE-2026-48120