https://seclists.org/oss-sec/2026/q4/579: [vim-security] Insecure Socket Directory in Vim < 9.2.1308
Published Nov 8, 2026
·Updated
Affected Software
1 affected component
vim Vim<9.2.1308
The issue affects Vim versions before 9.2.1308 when the socketserver backend of the clientserver feature is used. The socket directory is created under $XDG_RUNTIME_DIR/vim or $TMPDIR/vim-<uid>; if $TMPDIR is unset, the path is under /tmp.
An attacker needs local access and the ability to create the victim's socket directory before Vim does. In particular, a world-writable /tmp allows another user to pre-create /tmp/vim-<uid> with attacker-controlled ownership and permissions.
The attacker can connect to or replace the victim's Vim server socket. This can result in arbitrary Vim expressions being evaluated in the victim's Vim process.
Upgrade Vim to version 9.2.1308 or later. Until upgrading, avoid using the socketserver clientserver backend in environments where untrusted local users can pre-create the socket directory.