CVE-2026-39881
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Vim prior to version 9.2.0316 has a command injection vulnerability in its netbeans interface. A malicious netbeans server can execute arbitrary Ex commands when Vim connects, via unsanitized strings in defineAnnoType and specialKeys messages.
Risk Assessment
An attacker can remotely execute arbitrary commands in the Vim editor, potentially leading to full system compromise.
Recommendation
Update Vim to version 9.2.0316 or later.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.