Code execution via unsanitized path interpolation

Command injection in nnn 5.2 allows attackers to execute shell commands via a crafted directory name during batch copy or move. The batch copy and move workflow embeds the current path variable into a generated shell command without neutralizing single quotes or other shell metacharacters from the directory name. Exploitation requires the victim to enter an attacker-controlled directory from a shared filesystem, removable media, or an extracted archive and then start the batch copy or move action, after which the injected command runs with the privileges of the nnn process.