CVE-2026-57453: Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction
Last updated 2 July 2026
Other sources
Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.
— NVD
Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.0735-1 - Upgrade
Upgrade
Vim (bundled zip plugin: zip.vim)to a version that resolves this vulnerability.Fixed in 9.2.0678
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57453?
CVE-2026-57453 has a medium severity rating of 6.5.
How do I fix CVE-2026-57453?
To mitigate CVE-2026-57453, update Vim to version 9.2.0678 or later where the vulnerability is addressed.
What types of attacks are possible with CVE-2026-57453?
CVE-2026-57453 allows for PowerShell command injection through unescaped filenames during zip file operations.
What versions of Vim are affected by CVE-2026-57453?
Versions of Vim from 9.1.1784 until 9.2.0678 are affected by CVE-2026-57453.
What components of Vim are involved in CVE-2026-57453?
The issue in CVE-2026-57453 involves the bundled zip plugin autoload/zip.vim.