CyberRota Analysis
AI-GeneratedThe Kakoune code editor is vulnerable due to a flaw in the default `autorestore.kak` script, which allows malicious backup files to execute arbitrary Kakoune and shell commands upon opening a file. This poses a significant risk, as it can lead to unauthorized command execution on the user's system. Users and organizations utilizing Kakoune prior to version 2026.05.21 should prioritize updating to the latest version or disabling the autorestore feature to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.