https://seclists.org/oss-sec/2026/q3/725: [vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090

Q: What conditions are required for exploitation?

An attacker needs to cause Vim to handle a buffer whose file name contains an Ex command separator such as `|`, and a user must jump to a sign in that buffer while the buffer is not displayed in any window. In that path, the file name is incorporated into an Ex command without escaping.

Q: Which Vim versions are affected?

The issue affects Vim versions earlier than 9.2.1090. The supplied information does not identify affected downstream packages or distributions.

Q: How can I assess whether a system is exposed?

Check whether the installed Vim version is earlier than 9.2.1090 and whether users can open or operate on files with attacker-controlled names containing `|`. Exposure specifically depends on use of sign jumping for a buffer that is not currently shown in a window.

Q: Is there a CVE identifier for this issue?

A CVE was requested but had not yet been assigned as of the published advisory information.

Published Sep 12, 2026

Updated

Affected Software

1 affected component

vim Vim<9.2.1090

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs to cause Vim to handle a buffer whose file name contains an Ex command separator such as `|`, and a user must jump to a sign in that buffer while the buffer is not displayed in any window. In that path, the file name is incorporated into an Ex command without escaping.

Which Vim versions are affected?

The issue affects Vim versions earlier than 9.2.1090. The supplied information does not identify affected downstream packages or distributions.

How can I assess whether a system is exposed?

Check whether the installed Vim version is earlier than 9.2.1090 and whether users can open or operate on files with attacker-controlled names containing `|`. Exposure specifically depends on use of sign jumping for a buffer that is not currently shown in a window.

Is there a CVE identifier for this issue?

A CVE was requested but had not yet been assigned as of the published advisory information.