CVE-2026-44656
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In Vim prior to version 9.2.0435, an OS command injection vulnerability exists in the :find command-line completion. When the path option contains backtick-enclosed shell commands, they are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing arbitrary command execution when the user opens a file and triggers :find completion.
Risk Assessment
An attacker who controls file contents can force a user to execute arbitrary system commands when opening the file in Vim and triggering :find completion, potentially leading to system compromise.
Recommendation
Update Vim to version 9.2.0435 or later, which contains the fix.
Other vulnerabilities in Vim
See all- CVE-2017-11109High
Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.
- CVE-2016-1248High
Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
- CVE-2024-43802Medium
Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.
- CVE-2024-47814Low
In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.
- CVE-2026-34714Critical
A vulnerability in Vim before version 9.2.0272 allows immediate code execution upon opening a crafted file in the default configuration. The issue is due to %{expr} injection in tabpanel lacking the P_MLE flag.
- CVE-2017-6350Critical
An integer overflow at an unserialize_uep memory allocation site occurs for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
- CVE-2017-6349Critical
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
- CVE-2017-5953Critical
Vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
- CVE-2026-43961High
Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.
- CVE-2026-73073High
Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS