Command injection in Vim - CVE-2026-57453
Published: June 22, 2026
Vulnerability identifier: #VU134975
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-57453
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands.
The vulnerability exists due to command injection in autoload/zip.vim PowerShell helper functions when processing crafted zip archive entry names via the PowerShell fallback. A remote attacker can trick the victim into opening, viewing, or extracting a crafted zip archive to execute arbitrary commands.
The vulnerable code path is reached only when Vim falls back to PowerShell instead of using external zip or unzip tools. User interaction is required to open, view, or extract the crafted archive entry.
Affected software
Vim
Ubuntu
vim (Ubuntu package)
Ubuntu
vim (Ubuntu package)
How to mitigate CVE-2026-57453
Install security update from vendor's website.
Vim - update to 9.2.0678
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm30, 2:7.4.1689-3ubuntu1.5+esm36, 2:8.0.1453-1ubuntu1.13+esm21, 2:8.1.2269-1ubuntu5.32+esm9, 2:8.2.3995-1ubuntu2.33, 2:9.1.0016-1ubuntu7.17, 2:9.1.0967-1ubuntu6.8, 2:9.1.2141-1ubuntu4.6
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm30, 2:7.4.1689-3ubuntu1.5+esm36, 2:8.0.1453-1ubuntu1.13+esm21, 2:8.1.2269-1ubuntu5.32+esm9, 2:8.2.3995-1ubuntu2.33, 2:9.1.0016-1ubuntu7.17, 2:9.1.0967-1ubuntu6.8, 2:9.1.2141-1ubuntu4.6