Vim PowerShell Command Injection via Zip Plugin

Executive Summary

CVE-2026-57453 is a security vulnerability in the zip.vim plugin bundled with Vim versions from 9.1.1784 until 9.2.0678. When the plugin falls back to using PowerShell to browse, read, extract, update, or delete entries in a zip archive, it improperly constructs the PowerShell command by quoting archive entry names only for the shell (cmd.exe) but not for PowerShell itself.

This improper quoting allows a crafted archive entry name containing PowerShell subexpressions (e.g., $(...)) to break out of the intended string context and execute arbitrary PowerShell commands with the privileges of the user running Vim. The vulnerability is triggered by opening, viewing, or extracting the malicious archive.

The issue was fixed in Vim version 9.2.0678 by introducing a new escaping function (PSEscape()) that properly escapes strings for PowerShell commands, preventing command injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary command execution on the affected system with the privileges of the user running Vim.

An attacker can craft a malicious zip archive with specially named entries that, when opened or extracted using the vulnerable Vim plugin, cause PowerShell to execute arbitrary commands.

The impact includes high confidentiality and integrity loss because arbitrary commands can be run, potentially leading to data theft, modification, or other malicious actions. The availability impact is low.

Exploitation requires user interaction (opening or extracting the malicious archive) and has a high attack complexity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Vim to version 9.2.0678 or later, where the issue has been fixed by properly escaping PowerShell commands in the zip.vim plugin.

Avoid opening or extracting zip archives with potentially untrusted or crafted entry names using vulnerable Vim versions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered when a user opens, views, or extracts a specially crafted zip archive using the vulnerable versions of Vim's zip.vim plugin on Windows systems where PowerShell is used as a fallback for zip operations.

Detection on a network or system level is challenging because the exploit requires user interaction and occurs locally within Vim when handling zip archives. There are no specific network signatures or commands provided in the available information to detect exploitation attempts.

To detect if your Vim installation is vulnerable, check the Vim version:

• vim --version

If the version is between 9.1.1784 and 9.2.0677 inclusive, the system is vulnerable and should be updated to at least 9.2.0678.

Since the vulnerability involves PowerShell command injection, monitoring PowerShell command execution logs for suspicious commands triggered by Vim could help detect exploitation attempts, but no specific commands or signatures are provided.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows arbitrary command execution with the privileges of the user running Vim, potentially leading to high confidentiality and integrity loss of data.

Such unauthorized access or manipulation of data could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive information and prevention of unauthorized access.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0