Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Executing a manipulation of the argument path can lead to command injection. It is possible to launch the attack on the local host. The exploit has been published and may be used. This patch is called f83e0dcaf8cf18de94828341b0a1a61a86c75baf. A patch should be applied to remediate this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-11487 A flaw has been found in Neovim up to 0.12.2. Affected by this issue is the function http://M.read of the file runtime/lua/vim/secure.lua of the component View Branch. Execu… https://www.cve.org/CVERecord?id=CVE-2026-11487
Post summary
The notice reports a new flaw in Neovim (up to 0.12.2) that affects the "M.read" function in secure.lua.
CVE-2026-11487 Command Injection in Neovim Up To 0.12.2 Via Path Argument Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11487
Post summary
Announces CVE-2026-11487: a command‑Injection flaw in Neovim ≤0.12.2 triggered by path argument manipulation; no PoC, exploit, or patch details are provided.