CVE-2026-44656: Vim Command Injection RCE Vulnerability

CVE-2026-44656 Overview

CVE-2026-44656 is an OS command injection vulnerability [CWE-78] in the Vim text editor affecting versions prior to 9.2.0435. The flaw resides in the :find command-line completion logic. When the path option contains backtick-enclosed shell commands, Vim executes those commands during file name completion. Because the path option lacks the P_SECURE flag, attackers can set it through a modeline embedded in a file. A user who opens a malicious file and triggers :find completion will execute arbitrary shell commands under their account.

Critical Impact

Opening an attacker-controlled file in Vim and invoking :find tab-completion leads to arbitrary shell command execution on the local user's system.

Affected Products

• Vim versions prior to 9.2.0435
• Systems where Vim modelines are enabled (default in many distributions)
• Linux, macOS, and BSD environments shipping Vim as the default editor

Discovery Timeline

• 2026-05-08 - CVE-2026-44656 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-44656

Vulnerability Analysis

The vulnerability stems from Vim's handling of the path option during file name completion in the :find Ex command. Vim expands backtick expressions in path entries by invoking the system shell, treating the resulting output as additional directory paths. This shell expansion runs before any user confirmation of the completion result. Because the path option is not marked as secure, a modeline in an untrusted file can rewrite it at file-open time. The end result is unsanitized shell execution triggered by ordinary editor usage [CWE-78].

Root Cause

The path option is missing the P_SECURE flag in Vim's option table. Options carrying P_SECURE cannot be modified from modelines or sandboxed contexts. Without it, an attacker who controls file contents can inject directives such as vim: set path=\id>/tmp/pwn`:into a modeline. When the file is opened, Vim parses the modeline, setspath, and the backtick contents are later passed to the shell during :findcompletion insrc/findfile.c`.

Attack Vector

Exploitation requires local user interaction. The attacker delivers a file containing a malicious modeline, for example through email, source repositories, or downloaded archives. The victim opens the file in Vim with modelines enabled and types :find followed by Tab. Vim then expands the backtick segment of path via the shell, executing the attacker's command with the user's privileges.

     {
 	buflen = copy_option_part(&path_option, buf, MAXPATHL, " ,");
 
+	// do not expand backticks, could have been set via a modeline
+	if (vim_strchr(buf, '`') != NULL)
+	    continue;
+
 	if (buf[0] == '.' && (buf[1] == NUL || vim_ispathsep(buf[1])))
 	{
 	    size_t  plen;

Source: Vim commit 190cb3c2b9c7. The patch in src/findfile.c skips any path entry containing a backtick, preventing shell evaluation during completion.

Detection Methods for CVE-2026-44656

Indicators of Compromise

• Files containing modelines that set the path option with backtick expressions, for example vim: set path=...\cmd`...:`
• Unexpected child processes of vim or gvim, such as sh -c invocations spawned during interactive editing sessions
• Shell history or audit log entries showing commands executed under the user's UID at the same time Vim was active

Detection Strategies

• Scan repositories, mail spools, and downloaded archives for modeline patterns that set path, backupskip, or other options containing backticks
• Monitor process creation telemetry for vim or gvim spawning shell interpreters, which is uncommon during normal text editing
• Alert on Vim processes writing to suspicious paths such as /tmp or making outbound network connections shortly after file open

Monitoring Recommendations

• Enable Linux auditd rules on execve events with parent process vim or gvim to flag shell execution chains
• Centralize endpoint process telemetry in a SIEM and build a rule for vim -> sh/bash -c parent-child relationships
• Track Vim version inventory across endpoints and developer workstations to confirm coverage of the 9.2.0435 update

How to Mitigate CVE-2026-44656

Immediate Actions Required

• Upgrade Vim to version 9.2.0435 or later on all endpoints, servers, and developer systems
• Disable modelines globally until patching completes by setting set nomodeline in /etc/vim/vimrc or ~/.vimrc
• Audit shared development environments and CI runners that open untrusted files in Vim

Patch Information

The issue is fixed in Vim 9.2.0435. The patch modifies src/findfile.c to skip any path entry containing a backtick, blocking shell expansion during :find completion. See the GitHub Security Advisory GHSA-hwg5-3cxw-wvvg and the Vim 9.2.0435 release notes.

Workarounds

• Set set nomodeline in the system or user vimrc to prevent modelines from altering options like path
• Use set modelines=0 as an alternative to disable modeline processing entirely
• Avoid invoking :find tab-completion when editing files from untrusted sources until the patch is deployed

# Configuration example: disable modelines system-wide
echo 'set nomodeline' | sudo tee -a /etc/vim/vimrc
echo 'set modelines=0' | sudo tee -a /etc/vim/vimrc

# Verify installed Vim version meets the fixed release
vim --version | head -n 1