CVE-2026-44656
OS Command Injection in Vim via :find Completion
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vim | vim | to 9.2.0435 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Vim text editor prior to version 9.2.0435. It is an OS command injection issue related to Vim's :find command-line completion feature.
When the 'path' option in Vim contains backtick-enclosed shell commands, those commands get executed during file name completion. Because the 'path' option lacks the P_SECURE flag, it can be set from a modeline within a file.
An attacker who controls the contents of a file can insert such a modeline, causing arbitrary shell commands to be executed when a user opens that file in Vim and triggers :find completion.
This vulnerability has been fixed in Vim version 9.2.0435.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary shell commands on your system when you open a maliciously crafted file in Vim and use the :find command-line completion.
Such command execution can lead to unauthorized actions, including data theft, system compromise, or further malware installation, depending on the commands executed.
Because the attack requires user interaction (opening the file and triggering :find completion), the risk depends on the likelihood of opening attacker-controlled files.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update Vim to version 9.2.0435 or later, where the issue has been patched.
Avoid opening untrusted files in Vim that could contain malicious modelines setting the path option with backtick-enclosed shell commands.