Nixpkgs security tracker
NIXPKGS-2026-2377
GitHub issue
published 8 hours ago
Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Permalink
CVE-2026-48120
8.6 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
13 packages
- kakoune-cr
- kakoune-lsp
- kakoune-unwrapped
- kakounePlugins.kakoune-lsp
- kakounePlugins.kakoune-buffers
- kakounePlugins.kakoune-rainbow
- kakounePlugins.kakoune-registers
- kakounePlugins.kakoune-catppuccin
- kakounePlugins.kakoune-easymotion
- kakounePlugins.kakoune-state-save
- kakounePlugins.kakoune-buffer-switcher
- kakounePlugins.kakoune-extra-filetypes
- kakounePlugins.kakoune-vertical-selection
- @LeSuisse accepted
- @LeSuisse published on GitHub
Kakoune has a Critical RCE via Autorestore Backup Filename Injection
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.
References
-
https://github.com/mawww/kakoune/security/advisories/GHSA-h99r-h8cp-vwcq x_refsource_CONFIRM
Affected products
kakoune
- ==< 2026.05.21
Matching in nixpkgs
pkgs.kakoune
Vim inspired text editor
-
nixos-unstable 2026.05.21
- nixpkgs-unstable 2026.05.21
- nixos-unstable-small 2026.05.21
-
nixos-26.05 2026.04.12
- nixos-26.05-small 2026.04.12
- nixpkgs-26.05-darwin 2026.04.12
Ignored packages (13)
pkgs.kakoune-cr
Command-line tool for Kakoune
-
nixos-unstable 0-unstable-2021-11-12
- nixpkgs-unstable 0-unstable-2021-11-12
- nixos-unstable-small 0-unstable-2021-11-12
-
nixos-26.05 0-unstable-2021-11-12
- nixos-26.05-small 0-unstable-2021-11-12
- nixpkgs-26.05-darwin 0-unstable-2021-11-12
pkgs.kakoune-lsp
Kakoune Language Server Protocol Client
pkgs.kakoune-unwrapped
Vim inspired text editor
-
nixos-unstable 2026.05.21
- nixpkgs-unstable 2026.05.21
- nixos-unstable-small 2026.05.21
-
nixos-26.05 2026.04.12
- nixos-26.05-small 2026.04.12
- nixpkgs-26.05-darwin 2026.04.12
pkgs.kakounePlugins.kakoune-lsp
Kakoune Language Server Protocol Client
pkgs.kakounePlugins.kakoune-buffers
None
-
nixos-unstable 2021-11-10
- nixpkgs-unstable 2021-11-10
- nixos-unstable-small 2021-11-10
-
nixos-26.05 2021-11-10
- nixos-26.05-small 2021-11-10
- nixpkgs-26.05-darwin 2021-11-10
pkgs.kakounePlugins.kakoune-rainbow
None
-
nixos-unstable 2020-09-01
- nixpkgs-unstable 2020-09-01
- nixos-unstable-small 2020-09-01
-
nixos-26.05 2020-09-01
- nixos-26.05-small 2020-09-01
- nixpkgs-26.05-darwin 2020-09-01
pkgs.kakounePlugins.kakoune-registers
None
-
nixos-unstable 2022-03-01
- nixpkgs-unstable 2022-03-01
- nixos-unstable-small 2022-03-01
-
nixos-26.05 2022-03-01
- nixos-26.05-small 2022-03-01
- nixpkgs-26.05-darwin 2022-03-01
pkgs.kakounePlugins.kakoune-catppuccin
Soothing pastel theme for Kakoune
-
nixos-unstable 0-unstable-2024-03-29
- nixpkgs-unstable 0-unstable-2024-03-29
- nixos-unstable-small 0-unstable-2024-03-29
-
nixos-26.05 0-unstable-2024-03-29
- nixos-26.05-small 0-unstable-2024-03-29
- nixpkgs-26.05-darwin 0-unstable-2024-03-29
pkgs.kakounePlugins.kakoune-easymotion
None
-
nixos-unstable 2020-03-09
- nixpkgs-unstable 2020-03-09
- nixos-unstable-small 2020-03-09
-
nixos-26.05 2020-03-09
- nixos-26.05-small 2020-03-09
- nixpkgs-26.05-darwin 2020-03-09
pkgs.kakounePlugins.kakoune-state-save
Help Kakoune save and restore state between sessions
-
nixos-unstable 2020-02-09
- nixpkgs-unstable 2020-02-09
- nixos-unstable-small 2020-02-09
-
nixos-26.05 2020-02-09
- nixos-26.05-small 2020-02-09
- nixpkgs-26.05-darwin 2020-02-09
pkgs.kakounePlugins.kakoune-buffer-switcher
None
-
nixos-unstable 2022-09-18
- nixpkgs-unstable 2022-09-18
- nixos-unstable-small 2022-09-18
-
nixos-26.05 2022-09-18
- nixos-26.05-small 2022-09-18
- nixpkgs-26.05-darwin 2022-09-18
pkgs.kakounePlugins.kakoune-extra-filetypes
None
-
nixos-unstable 2021-05-16
- nixpkgs-unstable 2021-05-16
- nixos-unstable-small 2021-05-16
-
nixos-26.05 2021-05-16
- nixos-26.05-small 2021-05-16
- nixpkgs-26.05-darwin 2021-05-16
-
nixos-unstable 2023-04-20
- nixpkgs-unstable 2023-04-20
- nixos-unstable-small 2023-04-20
-
nixos-26.05 2023-04-20
- nixos-26.05-small 2023-04-20
- nixpkgs-26.05-darwin 2023-04-20
Package maintainers
-
@philiptaron Philip Taron <philip.taron@gmail.com>