CVE-2026-48120
Description
A flaw was found in Kakoune, a code editor. A local attacker could exploit a vulnerability in the bundled autorestore.kak script by crafting malicious backup files. When a user simply opens a file, these malicious backup files can lead to the execution of arbitrary Kakoune and shell commands. This results in remote code execution on the affected system.
Statement
Opening a file in Kakoune triggers the default-enabled autorestore.kak script to parse local backup files, which can execute arbitrary Kakoune and shell commands within the user's session context. This vulnerability presents full impact across the CIA triad with complete compromise of Confidentiality, Integrity, and Availability (C:H, I:H, A:H) because the executed commands run with the complete privileges of the user running the editor. Systems are only exposed when opening files from untrusted directories containing attacker-controlled backup files; non-interactive executions, automated scripting environments, or interactive workflows operating strictly in isolated, trusted file systems remain entirely unaffected.
Mitigation
To mitigate this issue, disable the `autorestore` feature in Kakoune. This can be achieved by adding `autorestore-disable` to the user's `kakrc` configuration file. Disabling this feature will prevent the automatic restoration of files, which may affect user workflow. A restart of Kakoune is required for the change to take effect.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
