Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
CVSS Details
- CVSS 4.0 Base Score: 8.4 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade vim | Aug 19, 2026 | Aug 11, 2026 |
| Amazon_linux_2023 | — | Upgrade vim-debuginfoUpgrade xxd-debuginfoUpgrade vim-dataUpgrade vim-commonUpgrade vim-minimal-debuginfoUpgrade vim-debugsourceUpgrade vim-enhancedUpgrade vim-minimalUpgrade vim-enhanced-debuginfoUpgrade xxdUpgrade vim-filesystemUpgrade vim-default-editor | Sep 1, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade vim-X11-debuginfoUpgrade vim-debugsourceUpgrade vim-filesystemUpgrade vim-commonUpgrade vim-debuginfoUpgrade vim-X11Upgrade vim-minimalUpgrade vim-dataUpgrade xxd-debuginfoUpgrade xxdUpgrade vim-common-debuginfoUpgrade vim-enhancedUpgrade vim-enhanced-debuginfoUpgrade vim-minimal-debuginfo | Aug 20, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade xxd-debuginfoUpgrade vim-common-debuginfoUpgrade vim-debuginfoUpgrade vim-X11Upgrade vim-commonUpgrade vim-enhanced-debuginfoUpgrade vim-minimalUpgrade xxdUpgrade vim-debugsourceUpgrade vim-minimal-debuginfoUpgrade vim-X11-debuginfoUpgrade vim-enhanced | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade vim-nox (Ubuntu Pro)Upgrade xxd (Ubuntu Pro)Upgrade vim-common (Ubuntu Pro)Upgrade vim-gtkUpgrade vim-gtk3Upgrade vim-nox-py2 (Ubuntu Pro)Upgrade vim-tinyUpgrade vim (Ubuntu Pro)Upgrade xxdUpgrade vim-athena-py2 (Ubuntu Pro)Upgrade vim-runtimeUpgrade vim-gui-common (Ubuntu Pro)Upgrade vim-gtk3 (Ubuntu Pro)Upgrade vim-gtk (Ubuntu Pro)Upgrade vim-gui-commonUpgrade vim-runtime (Ubuntu Pro)Upgrade vim-gnome (Ubuntu Pro)Upgrade vim-lesstif (Ubuntu Pro)Upgrade vim-tiny (Ubuntu Pro)Upgrade vim-gtk3-py2 (Ubuntu Pro)Upgrade vim-gnome-py2 (Ubuntu Pro)Upgrade vim-gtk-py2 (Ubuntu Pro)Upgrade vim-commonUpgrade vim-athena (Ubuntu Pro)Upgrade vim-athenaUpgrade vim-motifUpgrade vimUpgrade vim-nox | Aug 23, 2026 | Aug 20, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 2, 2026 | Aug 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub