This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-48120 →

DEBIAN-CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup...

Original description

The description as published by the source.

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 kakoune

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 kakoune

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 kakoune

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.05.21-1"}]}]

References

advisory security-tracker.debian.org