VulnerabilityAnalyzed

CVE-2026-39881

Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages.

HIGH 7.8EPSS 0.62%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.62% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: vim/vim
Source: security-advisories@github.com

References

https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19Patch
https://github.com/vim/vim/releases/tag/v9.2.0316Release Notes
https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.