https://seclists.org/oss-sec/2026/q3/245: [vim-security] Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839
Published Jul 23, 2026
·Updated
Affected Software
1 affected component
vim Vim<9.2.0839
Frequently Asked Questions
1
What is the severity of CVE-* requested, not yet assigned*?
The severity of CVE-* requested, not yet assigned* is classified as medium.
2
How do I fix CVE-* requested, not yet assigned*?
To fix CVE-* requested, not yet assigned*, upgrade to Vim version 9.2.0839 or later.
3
What type of vulnerability is CVE-* requested, not yet assigned*?
CVE-* requested, not yet assigned* is an arbitrary code execution vulnerability.
4
Which versions of Vim are affected by CVE-* requested, not yet assigned*?
Vim versions prior to 9.2.0839 are affected by CVE-* requested, not yet assigned*.
5
What is the cause of CVE-* requested, not yet assigned*?
CVE-* requested, not yet assigned* is caused by improper neutralization of special elements used in an OS command.