ANCHORE-2026-39881

ANCHORE-2026-39881 PUBLISHED

Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.

Affected Products

Vendor	Product	Versions
vim	vim	0

Timeline

Apr 8, 2026 CVE Published
Apr 9, 2026 CVE Updated

References

https://github.com/vim/vim/commit/7ab76a86048ed492374ac6b19 url
https://github.com/vim/vim/releases/tag/v9.2.0316 url
https://github.com/vim/vim/security/advisories/GHSA-mr87-rhgv-7pw6 url

Open in Interactive Console →