Executive brief
Vim is a widely used open-source text editor. A security flaw in its NetBeans integration allows a malicious server to execute unauthorized commands on a user's computer if the user connects to it. This could lead to unauthorized file access or modification, potentially compromising sensitive data or system integrity.
Technical details
A command injection vulnerability exists in Vim's NetBeans interface due to improper sanitization of input strings. Specifically, the 'defineAnnoType' and 'specialKeys' protocol messages fail to neutralize special characters like the pipe symbol (|), which Vim uses as a command separator. When a user connects Vim to a malicious NetBeans server using the '-nb' flag, the server can send crafted messages that inject arbitrary Ex commands. This can result in arbitrary file reads/writes or full code execution via commands like ':call system()'. The issue is resolved in Vim version 9.2.0316.
Affected products
- Vim Vim < 9.2.0316
Timeline
- 2026-04-07: patched: Vulnerability fixed in patch 9.2.0316
- 2026-04-08: disclosed: Initial disclosure and NVD publication