Vulnerability · Published May 8, 2026 · Assigned by GitHub_M
CVE-2026-44656Vim: OS Command Injection via 'path' completion
Medium 4.6
In plain English
A medium-severity OS command injection in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | vim | 9.2.0437-r0 | ALPINE-CVE-2026-44656 |
| Alpine:v3.24 | vim | 9.2.0437-r0 | ALPINE-CVE-2026-44656 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2026-44656 |
| Debian:13 | vim | 2:9.1.1230-2+deb13u1 | DEBIAN-CVE-2026-44656 |
| Debian:14 | vim | 2:9.2.0461-1 | DEBIAN-CVE-2026-44656 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.30 | USN-8304-1 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.30 | UBUNTU-CVE-2026-44656 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.14 | USN-8304-1 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.14 | UBUNTU-CVE-2026-44656 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.5 | USN-8304-1 |
| Ubuntu:25.10 | vim | 2:9.1.0967-1ubuntu6.5 | UBUNTU-CVE-2026-44656 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.2 | UBUNTU-CVE-2026-44656 |
| Ubuntu:26.04:LTS | vim | 2:9.1.2141-1ubuntu4.2 | USN-8304-1 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/vim/vim/security/advisories/GHSA-hwg5-3cxw-wvvg x_refsource_CONFIRM
- https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0 x_refsource_MISC
- https://github.com/vim/vim/releases/tag/v9.2.0435 x_refsource_MISC