CVE-2026-57453
Undergoing Analysis Undergoing Analysis - In Progress
Vim PowerShell Command Injection via Zip Plugin

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: GitHub, Inc.

Description
Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-57453
EUVD
EUVD-2026-39446
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
vim vim From 9.1.1784 (inc) to 9.2.0678 (exc)
vim vim From 9.1.1784 (exc) to 9.2.0678 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-57453 is a security vulnerability in the zip.vim plugin bundled with Vim versions from 9.1.1784 until 9.2.0678. When the plugin falls back to using PowerShell to browse, read, extract, update, or delete entries in a zip archive, it improperly constructs the PowerShell command by quoting archive entry names only for the shell (cmd.exe) but not for PowerShell itself.

This improper quoting allows a crafted archive entry name containing PowerShell subexpressions (e.g., $(...)) to break out of the intended string context and execute arbitrary PowerShell commands with the privileges of the user running Vim. The vulnerability is triggered by opening, viewing, or extracting the malicious archive.

The issue was fixed in Vim version 9.2.0678 by introducing a new escaping function (PSEscape()) that properly escapes strings for PowerShell commands, preventing command injection.

Compliance Impact

The vulnerability allows arbitrary command execution with the privileges of the user running Vim, potentially leading to high confidentiality and integrity loss of data.

Such unauthorized access or manipulation of data could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and prevention of unauthorized access.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Impact Analysis

This vulnerability can lead to arbitrary command execution on the affected system with the privileges of the user running Vim.

An attacker can craft a malicious zip archive with specially named entries that, when opened or extracted using the vulnerable Vim plugin, cause PowerShell to execute arbitrary commands.

The impact includes high confidentiality and integrity loss because arbitrary commands can be run, potentially leading to data theft, modification, or other malicious actions. The availability impact is low.

Exploitation requires user interaction (opening or extracting the malicious archive) and has a high attack complexity.

Mitigation Strategies

To mitigate this vulnerability, update Vim to version 9.2.0678 or later, where the issue has been fixed by properly escaping PowerShell commands in the zip.vim plugin.

Avoid opening or extracting zip archives with potentially untrusted or crafted entry names using vulnerable Vim versions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart