Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-08 | 2 | Disclosure1General1 |
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | Disclosure1 |
vim OS Command Injection cve++ CVE-2026-44656 https://t.co/qc6AW9jlc9
Post summary
The tweet mentions a new CVE (CVE‑2026‑44656) detailing an OS command injection in Vim, but provides no further technical depth, exploit code, or patch information.
CVE-2026-44656 Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When … https://www.cve.org/CVERecord?id=CVE-2026-44656
Post summary
The text discloses that versions of Vim before 9.2.0435 have an OS command injection vulnerability in the :find command-line completion.
Vim'de path tamamlama özelliği üzerinden OS command injection bulunmuş. Dosya açmak istedin, shell açıldı. Klasik Vim hamlesi aslında — çıkmayı da bilmiyordun zaten, en azından şimdi saldırgan çıkış yolunu buluyor. CVE-2026-44656
Post summary
A new OS command injection vulnerability has been identified in Vim's path completion feature (CVE-2026-44656); the post provides no PoC, exploit, patch, or detailed technical info.
CVE-2026-44656 OS Command Injection in Vim Prior to Version 9.2.0435 via :find Completion https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44656
Post summary
The text announces a newly disclosed OS Command Injection vulnerability in Vim, providing affected version information and a reference to details, but contains no PoC, exploit, or mitigation mention.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vim | vim | - | - | - |