REDHAT-BUG-2514065: High severity vim Vim vulnerability

Q: What must an attacker do to trigger command execution?

The attacker needs to cause a user to use a Visual-mode selection with the K command in an affected shell, zsh, or PowerShell filetype context. The selected text is passed through keywordprg handling to bash, zsh, or PowerShell without safe shell-argument separation.

Q: Whose privileges are used for the executed commands?

Commands execute with the privileges of the user running Vim. The provided information does not indicate that elevated privileges are required.

Q: Which Vim versions are affected?

The issue affects Vim versions prior to 9.2.0839. It is fixed in Vim 9.2.0839.

Published Aug 11, 2026

Updated

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATHESCCHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Affected Software

1 affected component

vim Vim<9.2.0839

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vim to a version that resolves this vulnerability.
Fixed in 9.2.0839

Event History

Aug 11, 2026

Data Sourced

via Red Hat·04:11 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker do to trigger command execution?

The attacker needs to cause a user to use a Visual-mode selection with the K command in an affected shell, zsh, or PowerShell filetype context. The selected text is passed through keywordprg handling to bash, zsh, or PowerShell without safe shell-argument separation.

Whose privileges are used for the executed commands?

Commands execute with the privileges of the user running Vim. The provided information does not indicate that elevated privileges are required.

Which Vim versions are affected?

The issue affects Vim versions prior to 9.2.0839. It is fixed in Vim 9.2.0839.

REDHAT-BUG-2514065: High severity vim Vim vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to trigger command execution?

Whose privileges are used for the executed commands?

Which Vim versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to trigger command execution?

Whose privileges are used for the executed commands?

Which Vim versions are affected?