# CVE-2026-57453: Vim command injection in zip.vim plugin via PowerShell fallback

Source: https://junglewise.ai/threats/cve-2026-57453-vim-command-injection-in-zip-vim-plugin-via-powershell-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-57453 · Severity: medium · CVSS 6.5 · Published 2026-06-25

Vim is a widely used open-source text editor. A vulnerability in its built-in ZIP file plugin allows an attacker to execute malicious commands on a user's computer if the user opens or views a specially crafted ZIP archive. This occurs when Vim uses PowerShell as a backup method to handle ZIP files, potentially leading to a full system compromise or data theft depending on the user's permissions.

Technologies: [Vim](https://junglewise.ai/threats/technologies/vim). Vendors: [Vim](https://junglewise.ai/threats/vendors/vim).

## Quick answers

**Is CVE-2026-57453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57453 being exploited in the wild.

**How severe is CVE-2026-57453?** Medium severity, with a CVSS score of 6.5, published 25 June 2026.

**Which products and versions are affected?** Vim >= 9.1.1784, < 9.2.0678.

**Is there a fix for CVE-2026-57453?** A patch was published on 2026-06-20: Fixed in version 9.2.0678 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57453 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-57453?** Check whether you run Vim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the Vim zip.vim plugin (autoload/zip.vim) between versions 9.1.1784 and 9.2.0678. When the plugin falls back to PowerShell for ZIP operations (typically when external zip/unzip tools are missing), it constructs PowerShell commands using archive entry names quoted with shellescape(). Because shellescape() targets the system shell (like cmd.exe) rather than PowerShell's specific syntax, subexpressions like $(...) are not neutralized. An attacker can craft a ZIP file with malicious entry names that, when parsed by PowerShell during browsing or extraction, execute arbitrary code with the privileges of the Vim user. The issue is fixed in patch 9.2.0678 by introducing proper PowerShell-specific escaping.

## Affected products

- Vim Vim >= 9.1.1784, < 9.2.0678

## Timeline

- 2026-06-20: patched: Fixed in version 9.2.0678
- 2026-06-25: disclosed: Public advisory published

## References

- [https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99](https://github.com/vim/vim/commit/b2cc9be119d51212bf0d3f2a99)
- [https://github.com/vim/vim/releases/tag/v9.2.0678](https://github.com/vim/vim/releases/tag/v9.2.0678)
- [https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf](https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf)

## Related threats

- [Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim…](https://junglewise.ai/threats/cve-2026-73073-vim-is-an-open-source-command-line-text-editor-prior-to-9-2-0845)
- [Vim netrw code injection via menu construction](https://junglewise.ai/threats/cve-2026-73078-vim-netrw-code-injection-via-menu-construction)
- [Vim shell filetype plugin OS command injection via keyword lookup](https://junglewise.ai/threats/cve-2026-73077-vim-shell-filetype-plugin-os-command-injection-via-keyword-lookup)
- [Vim vimball arbitrary command execution via .VimballRecord](https://junglewise.ai/threats/cve-2026-73076-vim-vimball-arbitrary-command-execution-via-vimballrecord)
- [Vim out-of-bounds access in popup opacity handling](https://junglewise.ai/threats/cve-2026-73075-vim-out-of-bounds-access-in-popup-opacity-handling)