A high-severity injection vulnerability in the Kakoune code editor could allow for arbitrary code execution if a user is tricked into processing malicious input.

This vulnerability involves improper neutralization of special elements (CWE-74), which allows an attacker to inject malicious commands into the editor. The attack requires user interaction, as the malicious payload must be processed by the editor component to execute the downstream injection.

With a CVSS score of 8.6, this vulnerability represents a significant risk to the security of the local workstation or server environment where Kakoune is utilized. Successful exploitation could lead to full system compromise, data exfiltration, or unauthorized command execution with the privileges of the user running the editor. The impact is elevated by the potential for cross-platform impact and severe system-level consequences.

Immediate Action: Update the Kakoune editor to version 2026.05.21 or later to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Monitor local system logs for unexpected process execution or abnormal file system access originating from the Kakoune editor process.

Compensating Controls: Exercise extreme caution when opening files or scripts from untrusted sources within the editor until the application is updated.

Public Exploit Available: No (exploit_available: false)

Users of the Kakoune editor should update to the latest version immediately to mitigate the risk of injection attacks. Maintaining software currency is essential to prevent potential exploitation of this critical flaw.