Описание
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add autorestore-disable to the user kakrc will disable the autorestore feature.
A flaw was found in Kakoune, a code editor. A local attacker could exploit a vulnerability in the bundled autorestore.kak script by crafting malicious backup files. When a user simply opens a file, these malicious backup files can lead to the execution of arbitrary Kakoune and shell commands. This results in remote code execution on the affected system.
Отчет
Opening a file in Kakoune triggers the default-enabled autorestore.kak script to parse local backup files, which can execute arbitrary Kakoune and shell commands within the user's session context. This vulnerability presents full impact across the CIA triad with complete compromise of Confidentiality, Integrity, and Availability (C:H, I:H, A:H) because the executed commands run with the complete privileges of the user running the editor. Systems are only exposed when opening files from untrusted directories containing attacker-controlled backup files; non-interactive executions, automated scripting environments, or interactive workflows operating strictly in isolated, trusted file systems remain entirely unaffected.
Меры по смягчению последствий
To mitigate this issue, disable the autorestore feature in Kakoune. This can be achieved by adding autorestore-disable to the user's kakrc configuration file. Disabling this feature will prevent the automatic restoration of files, which may affect user workflow. A restart of Kakoune is required for the change to take effect.
Дополнительная информация
Статус:
EPSS
8.6 High
CVSS3
Связанные уязвимости
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore.kak` script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, add `autorestore-disable` to the user kakrc will disable the autorestore feature.
Kakoune is a code editor. Prior to version 2026.05.21, the bundled, en ...
EPSS
8.6 High
CVSS3