CVE-2026-44656

What it actually does

This vulnerability allows local OS command injection through Vim's :find command-line completion. If Vim's 'path' option contains backtick-enclosed shell syntax, Vim evaluates that shell command while completing file names for :find. Because the vulnerable versions do not mark the 'path' option as secure, an attacker can place a malicious modeline in a file so that simply opening the file in Vim sets the option; arbitrary commands then execute when the user invokes :find completion. Exploitation requires user interaction and executes with the privileges of the user running Vim.

Why it matters to the business

A malicious source file, configuration file, document, or repository content can cause command execution on a developer, administrator, or operator workstation when opened and used in Vim. This can lead to theft of source code or credentials, modification of local files, installation of persistence under the user's account, or lateral movement if the affected user has access to sensitive systems. The CVSS score is moderate and EPSS is currently low, and it is not listed in CISA KEV, but exposure can be widespread because Vim is commonly installed on Unix-like servers, developer workstations, and build environments.

How an attack unfolds

An attacker prepares a file containing a Vim modeline that sets the 'path' option to a value including a backtick-enclosed shell command. The attacker then delivers the file through a repository, patch, archive, support bundle, configuration example, log file, or other content likely to be opened in Vim. When a user opens the file in a vulnerable Vim version with modelines enabled, the modeline sets the unsafe 'path' option. The command is not executed immediately in all cases; execution occurs when the user triggers :find command-line completion, such as by typing :find followed by completion. Vim evaluates the backtick expression while completing file names, causing the embedded shell command to run with the user's privileges. The attacker can use this to run downloaders, credential collection commands, file modification commands, or other local payloads.

How to fix it

Upgrade Vim to version 9.2.0435 or later, where the issue is patched. If immediate upgrade is not possible, disable modelines globally or for high-risk users by configuring 'set nomodeline' in vimrc/gvimrc and system-wide Vim configuration. Avoid opening untrusted files in Vim with modelines enabled. Treat files from external repositories, patches, archives, and support bundles as untrusted until inspected. Security controls can also reduce impact by restricting outbound network access from developer and administrator workstations and monitoring child processes spawned by Vim.

How to confirm the fix worked

Confirm the installed Vim version is 9.2.0435 or later using 'vim --version' or the operating system package manager. Validate that modelines are disabled where used as a mitigation by checking Vim configuration for 'set nomodeline' and testing ':set modeline?' inside Vim. Review package inventory across servers, workstations, containers, and build images because Vim may be installed indirectly as a base utility. For source builds, confirm the applied patch level rather than relying only on package names.

Typical attack path

1. Attacker creates or modifies a text file to include a Vim modeline that sets the 'path' option with backtick-enclosed shell commands.
2. Attacker delivers the file through a source repository, email attachment, shared archive, issue attachment, configuration sample, or other trusted workflow.
3. A victim opens the file using a vulnerable Vim version before 9.2.0435 with modeline processing enabled.
4. The malicious modeline changes Vim's 'path' option for the editing session.
5. The victim invokes :find command-line completion.
6. Vim evaluates the backtick-enclosed shell command during completion.
7. The attacker's command runs locally with the privileges and environment of the Vim user.

How to detect it

To determine whether exploitation has already occurred, review endpoint process telemetry, EDR events, shell history, auditd logs, Sysmon logs, and terminal session logs for shell or scripting processes launched by Vim-related parent processes. Focus on events where vim, gvim, view, rvim, or vimdiff spawned /bin/sh, bash, dash, zsh, ksh, curl, wget, python, perl, ruby, nc, ncat, ssh, scp, chmod, or similar utilities shortly after a user opened an unfamiliar file. Search file repositories, downloaded archives, temporary directories, email attachments, issue attachments, and support bundles for Vim modelines that set 'path' and include backtick command substitution. Also review shell history and recently modified startup files for commands or persistence created around the time of suspicious editor activity. There are no publicly established threat actors or campaign-specific indicators in the provided data, so detection should be behavior- and artifact-based.

• vim: set path=`
• vi: set path=`
• ex: set path=`
• vim:se path=`
• vi:se path=`
• modeline path=`
• :set path=`
• :se path=`
• parent_process_name=vim process_name=sh
• parent_process_name=vim process_name=bash
• parent_process_name=vim process_name=dash
• parent_process_name=vim process_name=zsh
• parent_process_name=vim process_name=ksh
• parent_process_name=gvim process_name=sh
• parent_process_name=gvim process_name=bash
• parent_process_name=view process_name=sh
• parent_process_name=vimdiff process_name=sh
• vim --cmd
• set modeline
• set ml

What your security team should do

• Prioritize upgrading Vim to 9.2.0435 or later on developer workstations, administrator jump hosts, build systems, and servers where users open untrusted files.
• If patching cannot be completed quickly, deploy a temporary configuration setting to disable modelines globally: 'set nomodeline'.
• Hunt for suspicious files containing Vim modelines that set 'path' to values with backtick command substitution.
• Monitor endpoint telemetry for shell or scripting interpreters spawned by vim, gvim, view, rvim, or related editor binaries.
• Educate developers and administrators not to open untrusted repository files, patches, logs, or attachments in vulnerable Vim versions.
• Add repository and file-ingestion scanning rules for Vim modelines containing backticks in option values.
• Review high-value workstations for credential theft or persistence if suspicious Vim child processes are observed.