Code Execution Flaws Expose Vim netrw and SiYuan Users to Endpoint Compromise
Two newly disclosed vulnerabilities affect widely used desktop productivity tools and could let attackers execute code in the context of the logged-in user. CVE-2026-28417 impacts Vim's netrw plugin and allows OS command injection with user interaction, potentially exposing the victim's files, environment variables, and active authentication tokens. The issue is rated CVSS 4.4 (Medium) and appears limited to local exploitation, but it could still support persistence, sensitive file theft, or follow-on lateral movement from a developer workstation.
A more severe flaw, CVE-2026-39846, affects the SiYuan Electron client and enables remote code execution through a stored XSS condition delivered via synchronized note content. The vulnerability carries a CVSS 9.1 rating and can be triggered when a user opens a malicious synchronized note, allowing silent background execution with the victim user's privileges. Reporting indicates a proof of concept exists, making targeted compromise plausible even though neither issue was reported as actively exploited at disclosure and the Vim flaw was not listed in CISA's Known Exploited Vulnerabilities catalog.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-39846 in SiYuan Electron client is publicly disclosed
A critical vulnerability affecting the SiYuan Electron client was disclosed, describing remote code execution via stored XSS delivered through synchronized note files. The report assigned a CVSS 9.1 score and noted that a proof of concept existed, making targeted attacks plausible.
CVE-2026-28417 in Vim netrw plugin is publicly disclosed
A command injection vulnerability in the Vim netrw plugin was disclosed, with potential arbitrary code execution in the context of the user running Vim. The disclosure noted a CVSS 4.4 severity and stated there were no known active exploitation campaigns or CISA KEV listing at the time.
Sources
2 references tracked. Mallory keeps watching after this page renders.
CVE-2026-39846: CVE-2026-39846: Remote Code Execution via Stored XSS in SiYuan Electron Client | CVEReports
cvereports.com
Open sourceCVE-2026-28417: CVE-2026-28417: OS Command Injection in Vim netrw Plugin | CVEReports
cvereports.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Code Execution Vulnerabilities Reported in Vim
German CERT advisories identified **code execution vulnerabilities** in `vim`, the widely used text editor, in two separate notices. The advisories, `2026-0782` and `2026-0886`, both describe flaws that could allow an attacker to execute code, indicating ongoing security issues affecting the application. The notices provide limited public detail, but the repeated classification of the issue as code execution highlights potential risk for systems where `vim` is installed or used to process untrusted content. Organizations using `vim` should review the associated advisories, determine affected versions in their environments, and prioritize vendor patches or other mitigations as they become available.
May 4, 2026
SiYuan Flaws Exposed Files and Enabled Desktop Command Execution
SiYuan disclosed two high-severity vulnerabilities affecting its personal knowledge management platform, including an arbitrary file-read issue tracked as **`CVE-2026-32938`** and a stored XSS flaw tracked as **`CVE-2026-34448`**. In SiYuan **3.6.0 and earlier**, the desktop publish service endpoint **`/api/lute/html2BlockDOM`** could copy local files referenced through **`file://`** links into the workspace assets directory without properly validating sensitive paths. Because authenticated users could then access **`GET /assets/*path`**, a publish-service visitor could exfiltrate readable local files from the desktop environment. The issue was fixed in **3.6.1**. A separate flaw in SiYuan **before 3.6.2** allowed an attacker to plant a malicious URL in an Attribute View field and trigger stored XSS when a victim opened Gallery or Kanban views configured with **"Cover From -> Asset Field"**. The application accepted arbitrary HTTP(S) URLs without extensions as images and injected them into an **`<img src="...">`** attribute without escaping. In the Electron desktop client, where **`nodeIntegration`** was enabled and **`contextIsolation`** was disabled, the XSS could escalate to arbitrary operating-system command execution under the victim’s account. SiYuan patched the command-execution path in **3.6.2**, leaving affected organizations to prioritize upgrades across both releases.
Apr 1, 2026
Vim Fixed Two Command Injection Flaws in Tag Handling and netrw
The Vim project disclosed and patched two medium-severity command injection vulnerabilities that could let attackers run shell commands as the local Vim user. One flaw, fixed in `v9.2.0357`, affected tag navigation in versions before that release: Vim passed the filename field from a `tags` file through wildcard expansion, allowing backtick expressions in a malicious tag entry to trigger command execution when a user invoked tag lookups such as `:tag`, `Ctrl-]`, or `vim -t`. Because Vim checks for `tags` files in the working directory by default, a repository-hosted malicious `tags` file was identified as a plausible delivery path. A second flaw, fixed in `v9.2.0383`, affected Vim's bundled `netrw` plugin in versions earlier than that patch. The bug allowed crafted `sftp://` or `file://` URLs to influence temporary filenames derived from attacker-controlled suffixes, which could then be passed to external programs such as `sftp` or configured file handlers without proper escaping, leading to arbitrary OS command execution when a user opened a malicious URL. The netrw issue was reported by Joshua Rogers of AISLE Research Team, and both disclosures said CVE assignments had been requested but were not yet available at publication time.
Apr 26, 2026