CVE-2026-57453

Name of the Vulnerable Software and Affected Versions Vim versions 9.1.1784 through 9.2.0677

Description When the bundled zip plugin autoload/zip.vim uses PowerShell to browse, read, extract, update, or delete entries in a zip archive, it constructs the PowerShell command by quoting archive entry names only for the shell and not for PowerShell itself. A specially crafted entry name can escape the intended string context, allowing PowerShell to execute arbitrary commands with the privileges of the user running the application. This is triggered when opening, viewing, or extracting the archive.

Recommendations Update to version 9.2.0678.