CVE-2026-44656

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0435

Description An OS command injection issue exists in the :find command-line completion. When the path option contains shell commands enclosed in backticks, these commands are executed during file name completion. Since the path option lacks the P SECURE flag, it can be modified via a modeline. This allows an attacker who controls a file's content to execute arbitrary shell commands if a user opens that file and triggers the :find completion.

Recommendations Update to version 9.2.0435.