CVE-2026-39881

Published: Apr 8, 2026Modified: Jul 24, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Affected (1)

Products: Vim: Vim

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Before 9.2.0316

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19

Source: security-advisories@github.com

Patch

https://github.com/vim/vim/releases/tag/v9.2.0316

Source: security-advisories@github.com

Release Notes

https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.