Most recent entries from all

bdu:2026-14501

BELL-CVE-2026-57453

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

EUVD-2026-330657

fkie_cve-2026-57453

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.

msrc_CVE-2026-57453 — Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction

msrc_CVE-2026-57453

RHSA-2026:57614 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

vim: arbitrary command execution via modeline sandbox bypass vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass vim: Vim: Arbitrary code execution via command injection in NetBeans interface vim: Command injection allows arbitrary code execution via malicious tag files vim: Vimscript injection via unescaped filename in netrw s:NetrwMarkFile() filter() expression allows arbitrary code execution vim: Vim: Arbitrary command execution via :find command-line completion vim: Vim: Heap buffer overflow allows arbitrary code execution or denial of service vim: command injection when decompressing .tgz archives vim: Vim: Arbitrary Code Execution via crafted directory names vim: Vim: Arbitrary code execution via crafted step-definition patterns vim: Vim: Arbitrary code execution via Python omni-completion vim: Vim: Denial of Service via out-of-bounds write in terminal handling vim: Vim: Arbitrary code execution through Python omni-completion. vim: Vim: Denial of service via crafted undo file vim: Vim: Arbitrary code execution via crafted zip archive entry names vim: Vim: Out-of-bounds Read with Text Properties vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

UBUNTU-CVE-2026-57453

Affected: Ubuntu:26.04:LTS: vim

WID-SEC-W-2026-2026 — vim: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen, und um einen Denial of Service Angriff durchzuführen.