Skip to content
OpenAdvisories
Medium · 4.6 Public exploit CVE-2026-44656 EUVD-2026-28869

Vim: OS Command Injection via 'path' completion

Published May 8, 2026 · Updated May 11, 2026 · Assigned by GitHub_M

Vendor: vim Product: vim Package: vim Package: vim Package: vim Package: vim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.

Affected products

VendorProductAffectedFixed
vim vim < 9.2.0435 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.2.0461-1 —
Debian 13 vim 2:9.1.1230-2+deb13u1 —
Debian 12 vim No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.2 USN-8304-1
Ubuntu 25.10 vim 2:9.1.0967-1ubuntu6.5 USN-8304-1
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.14 USN-8304-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.30 USN-8304-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm5 USN-8304-1
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm17 USN-8304-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm32 USN-8304-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm26 USN-8304-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 vim +8 9.2.967-1.1.hum1 RHSA-2026:57614

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 vim 9.2.0530-150000.5.94.1 SUSE-SU-2026:2313-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 vim 9.2.0530-150000.5.94.1 SUSE-SU-2026:2313-1
SLE Micro 6.2 vim 9.2.0530-160000.1.1 SUSE-SU-2026:21833-1
SLE Micro 5.4 vim 9.2.0530-150000.5.94.1 SUSE-SU-2026:2313-1
SLE Micro 5.3 vim 9.2.0530-150000.5.94.1 SUSE-SU-2026:2313-1
SLE HPC 15 SP4 vim 9.2.0530-150000.5.94.1 SUSE-SU-2026:2313-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed vim 9.2.0530-1.1 openSUSE-SU-2026:11114-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.2.0437-r0 —
Alpine v3.23 vim 9.2.0437-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.597-1.amzn2023.0.1 ALAS2023-2026-1862

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.2.0461-1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • CryingN/CVE-2026-44656 ★ 1 · May 9, 2026

    This repository provides a reproduction environment for CVE-2026-44656.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

References