Executive brief
Vim is a widely used open-source text editor. A security flaw allows a malicious file to execute unauthorized commands on a user's computer if the user opens the file and attempts to use the ':find' command completion feature. This could lead to a full system compromise or unauthorized access to the user's data.
Technical details
An OS command injection vulnerability exists in Vim's ':find' command-line completion due to improper neutralization of special elements. The 'path' option, which is used to locate files, lacks the P_SECURE flag, allowing it to be modified via a file's modeline. If an attacker crafts a file with a modeline that sets 'path' to include backtick-enclosed shell commands, Vim's 'expand_in_path()' function will pass these to 'mch_expand_wildcards()', resulting in shell execution during filename completion (e.g., when a user presses Tab). This requires the 'modeline' feature to be enabled and user interaction to trigger completion. The vulnerability is addressed in version 9.2.0435 by adding the P_SECURE flag to the 'path' option and skipping entries containing backticks.
Affected products
- Vim Vim < 9.2.0435
Timeline
- 2026-05-03: patched: Vim patch 9.2.0435 released
- 2026-05-08: disclosed: CVE-2026-44656 published