OS Command Injection Vulnerability in Vim Package - CVE-2026-44656
Summary
ALPINE-CVE-2026-44656: Vim is an open source, command line text editor. Affects vim versions < 9.2.0437-r0. Fixed in 9.2.0437-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and versatility in editing text files. It supports various programming languages and is favored by developers for its powerful features, including syntax highlighting and extensive plugin support. However, prior to version 9.2.0435, Vim was susceptible to an OS command injection vulnerability that could be exploited through its :find command-line completion.
Vulnerability Detail
The vulnerability arises from the lack of the P_SECURE flag in the path option of Vim's :find command-line completion. This allows an attacker to embed backtick-enclosed shell commands within the path option, which are executed during file name completion. If a user opens a file containing such a modeline, arbitrary shell commands can be executed, potentially leading to unauthorized access or system compromise.
How To Fix
Minimum fixed version
9.2.0437-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening files from untrusted sources or files that may contain malicious modelines until they can update to the patched version of Vim.
Conclusion
The OS command injection vulnerability in Vim (CVE-2026-44656) poses significant risks to users who may inadvertently execute malicious commands through the :find command-line completion feature. It is crucial to update to the patched version 9.2.0437-r0 or later to mitigate these risks.
See every vulnerability recorded for vim →
FAQ
CVE-2026-44656 is a vulnerability in Vim that allows for OS command injection through the :find command-line completion feature.
If you are using a version of Vim prior to 9.2.0435, you are at risk. You can check your version by running 'vim --version' in the terminal.
Exploitation of this vulnerability can lead to arbitrary command execution, potentially allowing attackers to gain unauthorized access to the system.
Yes, tools like Vulert can monitor your project for open-source vulnerabilities in real-time using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
