CVE-2026-44656: Vim: OS Command Injection via 'path' completion
Last updated 14 May 2026
Other sources
Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the PSECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
— MITRE
Vim: OS Command Injection via 'path' completion
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.2.0461-1Fixed in 2:9.2.0524-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.2.0435 - Compensating control
Until Vim is upgraded, prevent untrusted files from being opened in Vim in a way that triggers :find command-line completion (e.g., avoid opening attacker-controlled files or disable workflows that use :find completion).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44656?
CVE-2026-44656 has a high severity rating due to its potential for OS command injection.
How do I fix CVE-2026-44656?
To fix CVE-2026-44656, update Vim to version 9.2.0435 or later.
What impact does CVE-2026-44656 have on users?
CVE-2026-44656 allows attackers to execute arbitrary OS commands through the Vim editor, posing a security risk.
Who is affected by CVE-2026-44656?
CVE-2026-44656 affects all versions of Vim prior to 9.2.0435 that use the :find command-line completion.
Is CVE-2026-44656 exploitative in nature?
Yes, CVE-2026-44656 can be exploited by an attacker to execute commands on the host system.