Vim Fixed Two Command Injection Flaws in Tag Handling and netrw
The Vim project disclosed and patched two medium-severity command injection vulnerabilities that could let attackers run shell commands as the local Vim user. One flaw, fixed in v9.2.0357, affected tag navigation in versions before that release: Vim passed the filename field from a tags file through wildcard expansion, allowing backtick expressions in a malicious tag entry to trigger command execution when a user invoked tag lookups such as :tag, Ctrl-], or vim -t. Because Vim checks for tags files in the working directory by default, a repository-hosted malicious tags file was identified as a plausible delivery path.
A second flaw, fixed in v9.2.0383, affected Vim's bundled netrw plugin in versions earlier than that patch. The bug allowed crafted sftp:// or file:// URLs to influence temporary filenames derived from attacker-controlled suffixes, which could then be passed to external programs such as sftp or configured file handlers without proper escaping, leading to arbitrary OS command execution when a user opened a malicious URL. The netrw issue was reported by Joshua Rogers of AISLE Research Team, and both disclosures said CVE assignments had been requested but were not yet available at publication time.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Vim discloses and fixes netrw command injection in patch v9.2.0383
Vim disclosed a medium-severity OS command injection vulnerability in the bundled netrw plugin affecting versions earlier than 9.2.0383. Reported by Joshua Rogers of AISLE Research Team, the flaw involved crafted URLs leading to unsafe temporary filenames, and the project published a GitHub Security Advisory and fixing commit in patch v9.2.0383.
Vim fixes tag filename command injection in patch v9.2.0357
A command injection flaw in Vim's handling of tag filenames was disclosed as affecting versions prior to 9.2.0357. The issue could allow shell command execution via backtick expansion when a user navigates tags from a malicious tags file, and Vim fixed it in patch v9.2.0357.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
oss-sec: [vim-security] Command injection via backtick expansion in tag filenames in Vim < v9.2.0357 - Infosec.Pub
infosec.pub
Open sourceoss-sec: [vim-security] OS Command Injection in netrw affects Vim < 9.2.0383
seclists.org
Open sourceoss-sec: [vim-security] Command injection via backtick expansion in tag filenames in Vim < v9.2.0357
seclists.org
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Command Injection in Vim tar.vim Lets Crafted .tgz Filenames Execute Shell Commands
Vim disclosed a medium-severity command injection flaw in its `tar.vim` plugin, tracked as **CVE-2026-46483** and **GHSA-2fpv-9ff7-xg5w**, affecting versions earlier than **9.2.479**. The bug is in `tar#Vimuntar()` in `runtime/autoload/tar.vim`, where `.tgz` archive filenames are passed to shell commands such as `gunzip` and `gzip -d` using `shellescape()` without the required special handling, allowing Vim command-line special-character expansion on Unix-like systems. A successful attack can execute arbitrary shell commands with the privileges of the user running Vim if a victim has the tar plugin enabled, has a malicious archive on disk, and manually runs the non-routine `:Vimuntar` command. The issue was reported and analyzed by **Aisle Research**, disclosed by **Christian Brabandt**, and fixed in **Vim patch v9.2.479**.
May 25, 2026
Code Execution Flaws Expose Vim netrw and SiYuan Users to Endpoint Compromise
Two newly disclosed vulnerabilities affect widely used desktop productivity tools and could let attackers execute code in the context of the logged-in user. **CVE-2026-28417** impacts Vim's `netrw` plugin and allows OS command injection with user interaction, potentially exposing the victim's files, environment variables, and active authentication tokens. The issue is rated **CVSS 4.4 (Medium)** and appears limited to local exploitation, but it could still support persistence, sensitive file theft, or follow-on lateral movement from a developer workstation. A more severe flaw, **CVE-2026-39846**, affects the SiYuan Electron client and enables remote code execution through a stored XSS condition delivered via synchronized note content. The vulnerability carries a **CVSS 9.1** rating and can be triggered when a user opens a malicious synchronized note, allowing silent background execution with the victim user's privileges. Reporting indicates a proof of concept exists, making targeted compromise plausible even though neither issue was reported as actively exploited at disclosure and the Vim flaw was not listed in CISA's Known Exploited Vulnerabilities catalog.
Apr 8, 2026
Vim modeline flaw enables arbitrary command execution via crafted files
A high-severity flaw in **Vim** allows arbitrary OS command execution when a user opens a specially crafted file in affected versions earlier than **9.2.0272**. The bug chain abuses the `tabpanel` option, which was missing the `P_MLE` flag and therefore let modelines inject `%{expr}` expressions even when `modelineexpr` was not enabled; the injected code was then able to escape the sandbox because `autocmd_add()` lacked a `check_secure()` call. The issue affects builds compiled with `+tabpanel`, including common `FEAT_HUGE` builds, and executes with the privileges of the user running Vim. Vim fixed the issue in patch **v9.2.0272** via commit `664701eb7576edb7c7c7d9f2d600815ec1f43459`, and the vulnerability is tracked as **CVE-2026-34714** and **GHSA-2gmj-rpqf-pxvh**. Follow-on discussion on `oss-sec` focused on both CVE coordination and safer defaults for modelines. Maintainers said GitHub Support declined to assign a CVE because one had already been issued, while participants identified the record as **CVE-2026-34714**, reportedly assigned by MITRE. Security researchers and community members also argued that Vim's `modeline` feature remains risky for untrusted files because it is enabled by default in many environments, recommending mitigations such as setting `nomodeline` and moving toward a whitelist-based modeline design or disabling the feature by default; commenters noted that Debian, and likely Ubuntu, have already shipped with modelines disabled by default for years.
Jun 8, 2026