Executive brief
Vim is a widely used open-source text editor. A vulnerability in its built-in ZIP file plugin allows an attacker to execute malicious commands on a user's computer if the user opens or views a specially crafted ZIP archive. This occurs when Vim uses PowerShell as a backup method to handle ZIP files, potentially leading to a full system compromise or data theft depending on the user's permissions.
Technical details
A command injection vulnerability exists in the Vim zip.vim plugin (autoload/zip.vim) between versions 9.1.1784 and 9.2.0678. When the plugin falls back to PowerShell for ZIP operations (typically when external zip/unzip tools are missing), it constructs PowerShell commands using archive entry names quoted with shellescape(). Because shellescape() targets the system shell (like cmd.exe) rather than PowerShell's specific syntax, subexpressions like $(...) are not neutralized. An attacker can craft a ZIP file with malicious entry names that, when parsed by PowerShell during browsing or extraction, execute arbitrary code with the privileges of the Vim user. The issue is fixed in patch 9.2.0678 by introducing proper PowerShell-specific escaping.
Affected products
- Vim Vim >= 9.1.1784, < 9.2.0678
Timeline
- 2026-06-20: patched: Fixed in version 9.2.0678
- 2026-06-25: disclosed: Public advisory published