Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44656.json",
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "GitHub_M"
}{
"source": [
"AFFECTED_FIELD",
"CPE_RANGE",
"REFERENCES"
],
"cpe": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.2.0435"
},
{
"introduced": "0"
},
{
"fixed": "9.2.0435"
}
]
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44656.json"
[
{
"source": "https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0",
"deprecated": false,
"digest": {
"line_hashes": [
"199795358836533694574505217138417136705",
"48455900271478543553469178429030465173",
"163289126751779231006116225502884265582",
"79807469000743406271460294016623131445"
],
"threshold": 0.9
},
"target": {
"file": "src/optiondefs.h"
},
"signature_version": "v1",
"id": "CVE-2026-44656-6a2065af",
"signature_type": "Line"
},
{
"source": "https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0",
"deprecated": false,
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"57428957652300400776657341874131777200",
"234501858693217242553013122104646213264",
"187515071567613249328500439546193319783"
],
"threshold": 0.9
},
"target": {
"file": "src/version.c"
},
"signature_version": "v1",
"id": "CVE-2026-44656-73b2b5cb",
"signature_type": "Line"
},
{
"signature_type": "Function",
"source": "https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0",
"digest": {
"function_hash": "290272449867785336561033197407716410462",
"length": 1373.0
},
"target": {
"file": "src/findfile.c",
"function": "expand_path_option"
},
"signature_version": "v1",
"id": "CVE-2026-44656-9399648f",
"deprecated": false
},
{
"signature_type": "Line",
"source": "https://github.com/vim/vim/commit/190cb3c2b9c769a3972bcfd991a7b5b6cb771ef0",
"digest": {
"line_hashes": [
"231738325713796219568813278478621623970",
"212526934118186201959257723338696680736",
"79913779004389620159106326428675341866"
],
"threshold": 0.9
},
"target": {
"file": "src/findfile.c"
},
"signature_version": "v1",
"id": "CVE-2026-44656-b8b8e705",
"deprecated": false
}
]
"2026-06-18T17:57:59Z"