CVE-2026-57453

What it actually does

This is a command injection flaw in Vim’s bundled zip plugin, autoload/zip.vim, affecting versions from 9.1.1784 up to but not including 9.2.0678. When Vim on Windows falls back to PowerShell to browse, read, extract, update, or delete entries in a ZIP archive, the plugin embeds ZIP entry names into a PowerShell command without correctly quoting them for PowerShell parsing. A malicious ZIP archive can contain a crafted entry name that escapes the intended string context and causes arbitrary PowerShell commands to run with the privileges of the user running Vim. The vulnerability requires user interaction and local execution context: a victim must open, view, or manipulate the crafted archive through Vim’s ZIP handling path. Successful exploitation can compromise confidentiality and integrity of the user account and may allow limited availability impact depending on the payload.

Why it matters to the business

An attacker could use a malicious ZIP file to run commands on a developer, administrator, or operations workstation when the file is opened in Vim. This can lead to theft of local files, source code, credentials, SSH keys, cloud tokens, or other sensitive material accessible to that user, and can also be used to modify files or establish persistence under the user account. The operational risk is highest for Windows users who use Vim to inspect archives received from email, chat, ticket attachments, source repositories, or untrusted downloads. This issue is not listed in CISA KEV, has a low EPSS score, and has no reported public exploit maturity in the provided data, so broad automated exploitation is not currently indicated; however, targeted social-engineering attacks against technical users remain plausible.

How an attack unfolds

An attacker creates a ZIP archive containing an entry with a filename designed to break out of the PowerShell string constructed by Vim’s zip plugin. The attacker then delivers the archive to a victim, commonly through email, collaboration tooling, a repository, a support case, or a download link, and relies on the victim opening or browsing the archive with a vulnerable Vim version. When Vim’s bundled zip plugin handles the archive and falls back to PowerShell for ZIP operations, the crafted entry name is inserted into the generated PowerShell command in an unsafe way. PowerShell interprets attacker-controlled content as code rather than data and executes the injected command as the current user. The payload could read files, launch additional processes, download tooling, exfiltrate secrets, alter local project files, or create persistence, subject to the victim user’s permissions and endpoint controls.

How to fix it

Upgrade Vim to version 9.2.0678 or later. Because the flaw is in Vim’s bundled zip plugin, ensure the deployed Vim package actually includes the fixed autoload/zip.vim from 9.2.0678 or later, including versions distributed by operating system package managers, Windows installers, portable builds, developer workstation images, and embedded tool bundles. If immediate upgrade is not possible, mitigate by preventing Vim from handling untrusted ZIP archives, disabling or removing the vulnerable zip plugin where operationally feasible, using a separate trusted archive utility for ZIP inspection, and restricting PowerShell execution through endpoint controls such as application control, constrained language mode, script-block logging, and egress controls. Users should avoid opening ZIP archives from untrusted or unexpected sources in Vim until patched.

How to confirm the fix worked

Confirm that Vim reports version 9.2.0678 or later using the appropriate version command, such as vim --version or :version inside Vim. Verify that the runtime autoload/zip.vim file comes from the patched Vim distribution and has not been overridden by an older runtime path or user plugin directory. On managed endpoints, inventory installed Vim packages and portable Vim copies, especially on Windows developer and administrator workstations. To validate mitigation, test that untrusted ZIP files are not opened through vulnerable Vim ZIP handling and that PowerShell child-process execution from Vim is blocked or monitored where policy requires. For exposure assessment, search software inventory for Vim versions from 9.1.1784 through 9.2.0677 inclusive.

Typical attack path

1. Identify or assume a target who uses Vim on Windows to inspect ZIP archives.
2. Create a ZIP archive with a maliciously crafted entry name that injects PowerShell syntax when processed by Vim’s zip plugin.
3. Deliver the archive through a plausible channel such as email, chat, a code repository, a ticket attachment, or a download site.
4. Wait for the victim to open, browse, view, extract, update, or delete entries in the archive using a vulnerable Vim version.
5. Trigger Vim’s fallback PowerShell ZIP-handling path.
6. Execute attacker-controlled PowerShell commands with the privileges of the Vim user.
7. Use the executed command to stage further payloads, steal files or credentials, modify data, or establish user-level persistence.

How to detect it

Look for evidence that Vim or gVim spawned PowerShell unexpectedly, particularly on Windows systems and around the time a ZIP archive was opened, viewed, extracted, updated, or deleted. Relevant log sources include Windows Security process creation events if command-line auditing is enabled, Sysmon Event ID 1 process creation, PowerShell Operational logs, PowerShell script-block logs, EDR process trees, file creation telemetry, proxy/DNS logs, and email or collaboration attachment records. Suspicious patterns include powershell.exe or pwsh.exe with parent process vim.exe or gvim.exe; use of -EncodedCommand, -ExecutionPolicy Bypass, -NoProfile, -WindowStyle Hidden, Invoke-WebRequest, iwr, curl, wget, Start-BitsTransfer, Invoke-Expression, iex, Add-MpPreference, archive-related commands followed by network activity, or creation of persistence artifacts shortly after Vim handled a ZIP. Investigators should examine recently opened ZIP files for unusual entry names containing PowerShell metacharacters, quotes, semicolons, parentheses, dollar-sign expressions, backticks, or command separators. If exploitation is suspected, collect the archive, Vim runtime files, PowerShell logs, process trees, downloaded files, user profile persistence locations, browser and proxy history, and any files accessed or modified by the spawned command.

• ParentImage=*\\vim.exe Image=*\\powershell.exe
• ParentImage=*\\gvim.exe Image=*\\powershell.exe
• ParentImage=*\\vim.exe Image=*\\pwsh.exe
• ParentImage=*\\gvim.exe Image=*\\pwsh.exe
• powershell.exe -EncodedCommand
• powershell.exe -ExecutionPolicy Bypass
• powershell.exe -NoProfile
• powershell.exe -WindowStyle Hidden
• pwsh.exe -EncodedCommand
• Invoke-WebRequest
• iwr
• Invoke-Expression
• iex
• Start-BitsTransfer
• System.Net.WebClient
• DownloadString(
• DownloadFile(
• FromBase64String(
• Set-ExecutionPolicy Bypass
• Add-MpPreference
• schtasks /Create
• New-ScheduledTask
• reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup
• zip.vim

What your security team should do

• Prioritize upgrading Windows Vim installations to 9.2.0678 or later, especially on developer, build, administrator, and operations workstations.
• Inventory both managed and unmanaged Vim copies, including portable installations, package-manager installs, IDE-bundled tooling, and golden images.
• Temporarily instruct users not to open ZIP archives in Vim from email, chat, tickets, repositories, or other untrusted sources until patched.
• Enable or review PowerShell script-block, module, and process creation logging on workstations where Vim is used.
• Create detections for PowerShell spawned by Vim or gVim, especially with encoded commands, download cradles, archive manipulation, or suspicious outbound connections.
• Consider application control or endpoint policy to restrict PowerShell execution from text editors and other document-handling tools.
• Review recent endpoint telemetry for Vim or gVim launching PowerShell around the time users handled ZIP archives.
• Treat suspicious hits as potential user-context compromise and investigate for credential theft, source-code access, persistence, and lateral movement attempts.