CVE-2026-39881

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19	Patch
https://github.com/vim/vim/releases/tag/v9.2.0316	Release Notes
https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-08 21:17

Updated : 2026-07-24 21:10

NVD link : CVE-2026-39881

Mitre link : CVE-2026-39881

CVE.ORG link : CVE-2026-39881

JSON object : View

Products Affected

vim

vim

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-39881", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39881", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T13:50:15.915453Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "vim", "product": "vim", "versions": [{"status": "affected", "version": "< 9.2.0316"}]}]}], "published": "2026-04-08T21:17:00.400", "references": [{"url": "https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vim/vim/releases/tag/v9.2.0316", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316."}, {"lang": "es", "value": "Vim es un editor de texto de c\u00f3digo abierto, de l\u00ednea de comandos. Antes de la versi\u00f3n 9.2.0316, una vulnerabilidad de inyecci\u00f3n de comandos en la interfaz netbeans de Vim permite a un servidor netbeans malicioso ejecutar comandos Ex arbitrarios cuando Vim se conecta a \u00e9l, a trav\u00e9s de cadenas no saneadas en los mensajes de protocolo defineAnnoType y specialKeys. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 9.2.0316."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A710E88E-39B9-4ACE-B88A-1B5E60BC2674", "versionEndExcluding": "9.2.0316"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}