Ddugs

**Name of the Vulnerable Software and Affected Versions** Vim versions 9.1.1784 through 9.2.0677 **Description** When the bundled zip plugin `autoload/zip.vim` uses PowerShell to browse, read, extract, update, or delete entries in a zip archive, it constructs the PowerShell command by quoting archive entry names only for the shell and not for PowerShell itself. A specially crafted entry name can escape the intended string context, allowing PowerShell to execute arbitrary commands with the privileges of the user running the application. This is triggered when opening, viewing, or extracting the archive. **Recommendations** Update to version 9.2.0678.