CVE-2026-44656
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In Vim prior to version 9.2.0435, an OS command injection vulnerability exists in the :find command-line completion. When the path option contains backtick-enclosed shell commands, they are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing arbitrary command execution when the user opens a file and triggers :find completion.
Risk Assessment
An attacker who controls file contents can force a user to execute arbitrary system commands when opening the file in Vim and triggering :find completion, potentially leading to system compromise.
Recommendation
Update Vim to version 9.2.0435 or later, which contains the fix.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.