Description
Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inserting archive entry names that are quoted only for the shell, not for PowerShell. A crafted entry name can break out of the intended string context and cause PowerShell to execute arbitrary commands with the privileges of the user running Vim, triggered by opening, viewing or extracting the archive. This vulnerability is fixed in 9.2.0678.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vim | vim | >= 9.1.1784, < 9.2.0678 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.2.0782-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | vim | 2:9.1.2141-1ubuntu4.6 | USN-8500-1 |
| Ubuntu 25.10 | vim | 2:9.1.0967-1ubuntu6.8 | USN-8500-1 |
| Ubuntu 24.04 LTS | vim | 2:9.1.0016-1ubuntu7.17 | USN-8500-1 |
| Ubuntu 22.04 LTS | vim | 2:8.2.3995-1ubuntu2.33 | USN-8500-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | vim | 2:8.1.2269-1ubuntu5.32+esm9 | USN-8500-1 |
| Ubuntu Pro 18.04 LTS | vim | 2:8.0.1453-1ubuntu1.13+esm21 | USN-8500-1 |
| Ubuntu Pro 16.04 LTS | vim | 2:7.4.1689-3ubuntu1.5+esm36 | USN-8500-1 |
| Ubuntu Pro 14.04 LTS | vim | 2:7.4.052-1ubuntu3.1+esm30 | USN-8500-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | vim +8 | 2:9.2.967-1.1.hum1 | RHSA-2026:57614 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | vim | 9.2.0680-r0 | — |
| Alpine v3.23 | vim | 9.2.0854-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.2.725-1.amzn2023.0.1 | ALAS2023-2026-1940 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.2.0735-1 | — |
Advisories 4
- RHSA-2026:57614 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2026 vim: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
- ALAS2023-2026-1940 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
- USN-8500-1 vim vulnerabilities Ubuntu Security Notices (USN) · Jul 2, 2026