Executive brief
A vulnerability in Neovim, a popular text editor, allows for unauthorized command execution when a user attempts to view a file with a specially crafted filename. An attacker could use a malicious filename to run arbitrary commands on the user's local system, potentially leading to data loss or unauthorized system access. This issue occurs within the 'secure' file handling component designed to protect users from untrusted content.
Technical details
A command injection vulnerability exists in Neovim's 'vim.secure.read' function within 'runtime/lua/vim/secure.lua'. The root cause is the concatenation of an unescaped file path into the 'sview' Ex command, which allows an attacker to inject additional commands using characters like the pipe (|). An attacker with local access can trigger this by tricking a user or the system into processing a file with a malicious name (e.g., 'file|command'). This bypasses the security boundary intended for viewing untrusted files. The issue is fixed in commit f83e0dcaf8cf18de94828341b0a1a61a86c75baf by implementing 'fnameescape()' on the path argument.
Affected products
- Neovim Neovim up to 0.12.2
Timeline
- 2026-05-20: disclosed: Issue reported on GitHub and patch submitted via PR #39918
- 2026-05-20: patched: Fix merged into master branch
- 2026-06-08: advisory: CVE-2026-11487 published